AutoSSL Notifications and Renewal
I am receiving hundreds of daily notifications from certwatch that domains need to run genkey. It is about 1 year since I installed WHM/Cpanel/Cloudlinux.
I've been told once they are ready to expire it should auto-renew. Is there any way to manually run this ahead of time?
When I run autossl for all users I check the log file and in many cases it does say it ran for certain domains. But there also is a ton of errors.
Some are legit because DNS doesn't match as I've got some private IP based domains which is fine. There are only really maybe 3 people who actually have their own SSL certs. The rest were all auto generated when I installed.
Most people do not have SSH enabled. We have changed the SSH port to something else as well.
Some of the errors are because we are hosting email only and the website is elsewhere or vice versa.
Anyone clue me in on how to actually get this to stop spamming me daily and how to update all the certs?
-
Hello, You can turn off the AutoSSL feature for any accounts where you prefer it not attempt to issue a SSL certificate per the instructions at: Manage AutoSSL - Documentation - cPanel Documentation If you wish to allow AutoSSL to replace certificates that it did not issue, select the Allow AutoSSL to replace invalid or expiring non-AutoSSL certificates. option under the "Options" tab in "WHM >> Manage AutoSSL". AutoSSL will not attempt to replace pre-existing valid certificates that expire in more than three days. You'd have to delete those existing certificates if you wanted to override the expiration time frame. Thank you. 0 -
Hello, You can turn off the AutoSSL feature for any accounts where you prefer it not attempt to issue a SSL certificate per the instructions at: > Manage AutoSSL". AutoSSL will not attempt to replace pre-existing valid certificates that expire in more than three days. You'd have to delete those existing certificates if you wanted to override the expiration time frame. Thank you.
Already did. And autossl IS enabled for every single account. But I'm still getting a hundred or so emails per day (down to day 15 before expiry). Is there a way to force it to renew it before it expires?0 -
Already did. And autossl IS enabled for every single account. But I'm still getting a hundred or so emails per day (down to day 15 before expiry). Is there a way to force it to renew it before it expires?
Ok so I'd have to get notified for 27-28 days before expiry every single year? If I don't want to I need to manually go in and delete the old keys and manually run autossl?0 -
Hello, You'd need to delete the existing certificates if you want AutoSSL to issue a new certificate right away instead of waiting for the certificate issuance within the expiration window. AutoSSL certificates are automatically renewed based on the time frames referenced at: Manage AutoSSL - Documentation - cPanel Documentation The yearly expiration you are referring to would only occur on existing SSL certificates that were installed outside of the AutoSSL feature. Thank you. 0 -
Other question is - I can't find anywhere that you can modify the alerting parameters for certwatch. I don't need to get daily warnings. 0 -
I'm not sure if AutoSSL came in to CPanel in the last year? I'm wondering if it will replace these Cpanel issued certs. I don't think they were AutoSSL.
AutoSSL was introduced as a new feature in cPanel version 58. Here's some information from the > Manage AutoSSL". AutoSSL will not attempt to replace pre-existing valid certificates that expire in more than three days.
Will these new auto-ssl certs be valid 3rd party signed (so you don't get the browser warnings etc) ?
Yes, AutoSSL issues signed certificates that browsers will trust.Other question is - I can't find anywhere that you can modify the alerting parameters for certwatch. I don't need to get daily warnings.
I believe the "certwatch" cron job you are referring to stems from the crypto-utils package in CentOS. It's not something that cPanel installs or configures, so you could manually remove that cron job. Thank you.0 -
Ah that is what I was looking for then. Thanks. Actually I think it was Cloudlinux that did it. 0 -
Hello, I'm happy to see your questions have been answered. Let us know if we can be of any further assistance. Thanks! 0
Please sign in to leave a comment.
Comments
9 comments