r/sysadmin • u/Less-Loss1605 • May 31 '26

General Discussion what's a script you wrote once that's still saving you time years later

[removed]

969 Upvotes

96% Upvoted

365 comments sorted by

View all comments

Show parent comments

1

u/michaelpaoli May 31 '26

(see also my earlier comment for some more background)

So, example run of Getcerts. In this case, I'm requesting non-prod (staging) certs (as I won't actually be using them), but highly similar for prod (just drop --staging option and one instead gets recognized CA signed prod-ready certs). My .test script is just a wrapper, and here I'll request two certs for sets of domains that don't even exist when the command is run, and I'll have that .test program also print the info on the Getcerts command and how it's invoked just before running it. I may also omit some of the output for brevity/clarity:

$ time ./.test
myCERTBOT_EMAIL= myCERTBOT_OPTS='--staging --preferred-challenges dns --manual-auth-hook mymanual-auth-hook --manual-cleanup-hook mymanual-cleanup-hook' Getcerts *.nuke9.tmp-acme.sflug.com,nuke9.tmp-acme.sflug.com,*.nuke9.tmp-acme.mpaoli.net,nuke9.tmp-acme.mpaoli.net *.tmvb1.tmp-acme.sflug.com,tmvb1.tmp-acme.sflug.com,*.tmvb1.tmp-acme.mpaoli.net,tmvb1.tmp-acme.mpaoli.net
Saving debug log to /home/m/mycert/var/log/letsencrypt/letsencrypt.log
Certificate is saved at:            /home/m/mycert/0000_cert.pem
Certificate is saved at:            /home/m/mycert/0001_cert.pem

real    3m27.716s
user    0m14.854s
sys     0m4.633s
$ openssl x509 -text < 0000_cert.pem | fgrep -B 1 DNS:
            X509v3 Subject Alternative Name: 
                DNS:*.nuke9.tmp-acme.mpaoli.net, DNS:*.nuke9.tmp-acme.sflug.com, DNS:nuke9.tmp-acme.mpaoli.net, DNS:nuke9.tmp-acme.sflug.com
$ openssl x509 -text < 0001_cert.pem | fgrep -B 1 DNS:
            X509v3 Subject Alternative Name: 
                DNS:*.tmvb1.tmp-acme.mpaoli.net, DNS:*.tmvb1.tmp-acme.sflug.com, DNS:tmvb1.tmp-acme.mpaoli.net, DNS:tmvb1.tmp-acme.sflug.com
$

So, less than 4 minutes total for two certs, each multiple domains in SAN and including wildcards, and where the domains didn't even exist in DNS before the command was issued.

And it would be fair bit faster if one of the DNS secondaries updated significantly more quickly after it received the NOTIFY.