I can't find any documentation about their renewal practices. Since this is out of our control anyway and handled automatically by CDN77 I would just remove the |X509CertNearExpired alert for *.rsc.cdn77.org endpoints. I opened an issue for this: https://gitlab.torproject.org/tpo/tpa/prometheus-alerts/-/issues/24 |

On 2025-02-10 13:00, meskio via anti-censorship-alerts wrote:

Looks like this error is expected to happen in CDN77 and they renew the certificates closer to the expiration date. If so maybe we can tune this alert to don't warn so early.

cohosh, what do you think?

I think this is an automated alert from the blackbox exporter, we might need to talk with TPA to ask them if this can be configured.

Quoting alertmanager--- via anti-censorship-alerts (2025-02-10 13:34:27)

...

Total firing alerts: 2 Total resolved alerts: 0

## Firing Alerts

---

Time: 2025-01-26 11:51:40.651 +0000 UTC Summary: TLS certificate for https://1098762253.rsc.cdn77.org/debug is nearing expiry date Description: Certificate expiry date for https://1098762253.rsc.cdn77.org/debug is less than 28 days. It will expire in 12d 23h 17m 20s.

---

---

Time: 2025-01-26 11:51:40.651 +0000 UTC Summary: TLS certificate for https://1723079976.rsc.cdn77.org is nearing expiry date Description: Certificate expiry date for https://1723079976.rsc.cdn77.org is less than 28 days. It will expire in 12d 23h 17m 20s.

---

##Resolved Alerts