SSL Certificate has expired

[rartino]

For some reason netlify has issues renewing the let's encrypt certificate for providers.optimade.org. This is the error message:

SniCertificate::CertificateInvalidError: Unable to verify challenge for providers.optimade.org
We can’t renew your Let’s Encrypt certificate automatically until the issue is resolved. Check our troubleshooting guide for more information on how to fix the problem, and then renew the certificate

I'm investigating.

[rartino]

So, I've tracked this down to another CAA record problem. I have no idea how we actually managed to get a working SSL certificate when we set this up. I guess the optimade.org CAA record pointing at sectigo must have been added after we set this up on netlify (?!)

I've posted about the issue in their support forum here: https://community.netlify.com/t/no-caa-on-netlify-subdomains/19796 (which is the only support free users get).

If we are feeling stressed out by SSL on providers.optimade.org temporarily being out of order, the only quick solution would be to provision a separate sectigo certificate also for this subdomain. However, I suggest we wait until we at least get a response from netlify to see if this is something they may be interested in looking into at their side, since the key issue is a configuration difference between their setup and GitHub pages in regards to CAA records.

[blokhin]

Couldn’t you exclude returning back to Github pages?

[rartino]

@blokhin All parts of the CAA record resolution is outside our control, so there isn't anything we can "exclude". This is how the lookup goes:

1. Lookup of CAA records on providers.optimade.org. Formally, since this is a CNAME, it shouldn't have any other records.
2. The CNAME is followed, pointing to our netlify subdomain. Those are under netlify control, nothing we can do there except ask them.
3. Next step in the lookup is CAA records for optimade.org, where it has already been made clear that the single CAA record for sectigo will remain.

[rartino]

I'm starting to grasp the full complexity of this issue, and I don't think I can negotiate with Netlify for them to make changes that possibly will impact other customers...

The "in English please" version is that, for subdomains under optimade.org, due to a subtle configuration difference between GitHub pages and Netlify, we must use letsencrypt certificates for GitHub-hosted sites and we must use sectigo certificates on Netlify-hosted sites.

@gmrigna Do you / UCLovain pay something per sectigo certificate? A shortcut to solve this issue would be to install a manual sectigo cert also for providers.optimade.org by following the same procedure we took for optimade.org.

[gmrigna]

@rartino The process is under way. As soon as I get the certificate, we will proceed like last time...

[rartino]

@gmrigna Thanks for getting the certificate. Everything seems to be in order now. I don't see any errors from https://providers.optimade.org/

[gmrigna]

@rartino Thank you!