cert-shifter starts failing is not run within 24 hours of an update

[dlangille]

The find used by cert-shifter checks for changes which occurred in the past 24 hours (1 d)

see https://github.com/dlangille/anvil/blob/master/cert-shifter#L31

DIRS=`${FIND} ${CERT_SRC} -mtime -1 -type d -d 1`

I had a power outage and the server did not come back up within that 1 day period.

I suspect the power outage occurred after the certs had been renewed, but before they were copied over to the destination.

I solved it by changing from -mtime 1 to -mtime 70

Why 70? Why so large? This thing takes a long time to surface. You wouldn't notice until cert renewal time comes around (these are valid for 90 days). When my Nagios check start saying < 28 days left.

[dlangille]

I think the best solution: change -mtime 1 to -mtime N where N is how many days you think you might be powered off.

If, for example, 3 is used, this means any time you run the script, changes to a script are copied over at least three times:

• within the first day
• on the second day
• on the third day

[dlangille]

I think this is a better solution. It uses the mtimes on the fullchain.cer file, then invokes dirname. The result is the same higher-level directory names which the original find was supposed to locate.

DIRS=`${FIND} ${CERT_SRC} -mtime -10 -type f -d 2 -name fullchain.cer -exec dirname {} \; `

See also: https://twitter.com/DLangille/status/1148663213346742272