Certificates expiring on 2026-04-12

[github-actions]

The certificates on the following servers need to be updated before they expire:

• ci-release.nodejs.org, certificate valid until 2026-04-12
• ci.nodejs.org, certificate valid until 2026-04-12
• direct.nodejs.org, certificate valid until 2026-10-23
• nodejs.org, certificate valid until 2026-10-23
• unencrypted.nodejs.org, certificate valid until 2026-10-23

See doc/update-certificates.md for update instructions.

Generated by https://github.com/nodejs/build/actions/runs/24165247412.

[richardlau]

This will be the final yearly reissue we can do on our current subscription.

pre-paid till 2027-01-11

That might mean we will not get a full year out of the reissue.

Given the timeframe involved, I suggest that:

• We reissue since we pre-paid for the subscription and it is still active.
• We wait until after the security release is done next week before updating the machines and a Cloudflare.
• Revisit Automate SSL Cert infrastructure #4038 with the Foundation to figure out what we'll do for when the existing subscription expires.

[richardlau]

I'm unable to sign into the account (listed in the secrets repo). I've attempted a password recovery, but so far the recovery email has not arrived 😞.

[ryanaslett]

I'll doublecheck. The goGet ssl password in our openjs 1password and works.

[richardlau]

I'll doublecheck. The goGet ssl password in our openjs 1password and works.

Ah was the password changed then from what is in the Build WG secrets repo? If you have the working password in the OpenJS 1Password, can you take care of reissuing and updating the certificates before the current ones expire on 12 April 2026?

If you can confirm the password in the secrets repo is outdated, I can PR a change to the secrets repo to redirect people looking there to https://github.com/openjs-foundation/infrastructure.

[ryanaslett]

The password is still the same, the email changed to operations@openjsf.org -> Im leaving for vacation today until next tuesday, and the state of my local secrets repo looks like its going to take more time than I have to sort out before then, otherwise Id fix this.

I can take care of the certs next week.

[ryanaslett]

Working on this now: note: certs are only good for 199 days now due to new requirements from the CA/B Browser Forum

[richardlau]

Working on this now: note: certs are only good for 199 days now due to new requirements from the CA/B Browser Forum

That'd be around mid/late October? In any case the automation in this repository that opened this issue should open an issue 30 days prior to expiry, and I'm guessing from openjs-foundation/infrastructure#105 that gogetssl send reminders. But maybe that's near enough to January (when our subscription runs out) to be thinking about what happens next (e.g. does the Foundation pay for another subscription, or recommend switching to something else)?

[ryanaslett]

Oh, this is definintely easily automatable. We should just use whats already on the unofficial builds server (certbot) with lets encrypt, and use the cloudflare certificate manager on CF.

Now that we have the breathing room to do it, I'll add that to our backlog and get it done soon (before October for sure)

[ryanaslett]

Oh, also, the new certs are in place.

I updated www, 'unencrypted' (rsync server), and cloudflare.

[richardlau]

Oh, also, the new certs are in place.

I updated www, 'unencrypted' (rsync server), and cloudflare.

We'll need to update the Jenkins servers as well (as per the list in the issue description, which just got updated by the automation and has marked off the updated servers 🎉 ).