x/build/vcs-test,x/net/http2/h2demo: certificate is expiring

[FiloSottile]

The vcs-test.golang.org certificate will expire on July 16th, which suggests renewal is failing.

The most likely reason is that it might be built with an old version of x/crypto/acme/autocert which still uses ACVEv1, which Let's Encrypt recently turned off. In that case we should look into why we didn't get any emails from Let's Encrypt.

Regardless, we maybe should have alerts for expiring certificates and for error logs.

/cc @golang/release

[dmitshur]

Thanks for catching this.

In that case we should look into why we didn't get any emails from Let's Encrypt.

I believe it's because the autocert.Manager.Email field is simply unset. We should find an email address to use for this, and set it.

[gopherbot]

Change https://golang.org/cl/334532 mentions this issue: vcs-test/vcweb: add Autocert notification email

[heschi]

Redeploying vcs-test fixed the problem; it was ~2 years old. Leaving this open to track adding the email.

[heschi]

@FiloSottile do you happen to know how to get the email address change to take effect? Autocert doesn't support explicit account updates from what I could see. If I blow away the cache directory and the private key along with it, does that mean a new account will be created with the email associated? I don't want to burn a ton of time preventing a problem that might at worst cause us a little bit of annoyance in a few years.

[FiloSottile]

@heschi Yeah, you can blow away the cache and let it re-register.

[FiloSottile]

http2.golang.org also has expired. It probably needs redeploying as well.

[heschi]

Right you are. Done. (No email there either yet.)

[gopherbot]

Change https://golang.org/cl/334929 mentions this issue: http2/h2demo: add Autocert notification email