<?xml version="1.0"?>
<rss xmlns:dc="http://purl.org/dc/elements/1.1/" version="2.0">
  <channel>
    <title>Transition Technology: Ticket #687: Set up cert expiry date checking for all SSL certs</title>
    <link>http://localhost:8080/trac/ticket/687</link>
    <description>&lt;p&gt;
Last month the &lt;tt&gt;*.transitionnetwork.org&lt;/tt&gt; cert expired before it was replaced with a new one and users therefore got warnings for around half a day, see &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/685" title="task: SSL certificate about to expire? (closed: fixed)"&gt;ticket:685&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
A script to check the expiry dates was set up on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;wiki:PuffinServer&lt;/a&gt; on &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/685#comment:9" title="task: SSL certificate about to expire? (closed: fixed)"&gt;ticket:685#comment:9&lt;/a&gt; and this ticket is to document setting this up for &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer"&gt;wiki:PenguinServer&lt;/a&gt; and &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;wiki:ParrotServer&lt;/a&gt;.
&lt;/p&gt;
</description>
    <language>en-us</language>
    <image>
      <title>Transition Technology</title>
      <url>/trac/chrome/site/TransitionNetwork-Logo-Web-Small.jpg</url>
      <link>http://localhost:8080/trac/ticket/687</link>
    </image>
    <generator>Trac 0.12.5</generator>
    <item>
      
        <dc:creator>chris</dc:creator>

      <pubDate>Mon, 03 Feb 2014 14:04:58 GMT</pubDate>
      <title>hours, totalhours changed</title>
      <link>http://localhost:8080/trac/ticket/687#comment:1</link>
      <guid isPermaLink="false">http://localhost:8080/trac/ticket/687#comment:1</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;hours&lt;/strong&gt;
                changed from &lt;em&gt;0.0&lt;/em&gt; to &lt;em&gt;0.5&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;totalhours&lt;/strong&gt;
                changed from &lt;em&gt;0.0&lt;/em&gt; to &lt;em&gt;0.5&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
        &lt;p&gt;
&lt;tt&gt;ssl-cert-check&lt;/tt&gt; was already installed on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer"&gt;wiki:PenguinServer&lt;/a&gt; it's &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;wiki:PuffinServer&lt;/a&gt; and &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;wiki:ParrotServer&lt;/a&gt; which don't have it installed.
&lt;/p&gt;
&lt;p&gt;
On &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;wiki:ParrotServer&lt;/a&gt;:
&lt;/p&gt;
&lt;pre class="wiki"&gt;sudo -i
aptitude install ssl-cert-check
&lt;/pre&gt;&lt;p&gt;
These cron jobs were added:
&lt;/p&gt;
&lt;pre class="wiki"&gt;30 09 * * * ssl-cert-check -qac "/etc/ssl/wsh/cert.pem" -e "chris@webarchitects.co.uk"
31 09 * * * ssl-cert-check -qac "/etc/ssl/wsh/movie_cert.pem" -e "chris@webarchitects.co.uk"
&lt;/pre&gt;&lt;p&gt;
And they were also manually run, these email was the result:
&lt;/p&gt;
&lt;pre class="wiki"&gt;From: root &amp;lt;root@parrot.webarch.net&amp;gt;
Date: Mon, 03 Feb 2014 13:46:17 +0000
To: chris@webarchitects.co.uk
Subject: Certificate for FILE "(CN: intransitionmovie.com)" will expire in 30-days or less
The SSL certificate for FILE "(CN: intransitionmovie.com)" will expire on Feb 24 23:59:59 2014 GMT
&lt;/pre&gt;&lt;p&gt;
So that proves it working, the last time we go a new cert for this site was on &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/497" title="maintenance: New SSL cert needed for intransitionmovie.com (closed: fixed)"&gt;ticket:497&lt;/a&gt; however I'm not sure if we want to renew it this time, see &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/538#comment:8" title="maintenance: intransitionmovie.com checks and updates (closed: fixed)"&gt;ticket:538#comment:8&lt;/a&gt; I'll follow this up on that ticket.
&lt;/p&gt;
&lt;p&gt;
On &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;wiki:PuffinServer&lt;/a&gt;:
&lt;/p&gt;
&lt;pre class="wiki"&gt;aptitude install ssl-cert-check
&lt;/pre&gt;&lt;p&gt;
And this was added to my crontab (as the root crontab is clobbered by BOA):
&lt;/p&gt;
&lt;pre class="wiki"&gt;export EDITOR=vim
crontab -e -u chris
&lt;/pre&gt;&lt;pre class="wiki"&gt;# ssl cert check
32 09 * * * sudo ssl-cert-check -qac "/etc/ssl/transitionnetwork.org/transitionnetwork.org.crt" -e "chris@webarchitects.co.uk"
&lt;/pre&gt;
      </description>
      <category>Ticket</category>
    </item><item>
      
        <dc:creator>chris</dc:creator>

      <pubDate>Wed, 02 Apr 2014 10:01:19 GMT</pubDate>
      <title>status changed; resolution set</title>
      <link>http://localhost:8080/trac/ticket/687#comment:2</link>
      <guid isPermaLink="false">http://localhost:8080/trac/ticket/687#comment:2</guid>
      <description>
          &lt;ul&gt;
            &lt;li&gt;&lt;strong&gt;status&lt;/strong&gt;
                changed from &lt;em&gt;new&lt;/em&gt; to &lt;em&gt;closed&lt;/em&gt;
            &lt;/li&gt;
            &lt;li&gt;&lt;strong&gt;resolution&lt;/strong&gt;
                set to &lt;em&gt;fixed&lt;/em&gt;
            &lt;/li&gt;
          &lt;/ul&gt;
        &lt;p&gt;
Movie cert check on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;wiki:ParrotServer&lt;/a&gt; has been removed as we are not updating that and the site has been archived and moved to &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer"&gt;wiki:PenguinServer&lt;/a&gt;.
&lt;/p&gt;
      </description>
      <category>Ticket</category>
    </item>
 </channel>
</rss>