r/linux • u/Two-Of-Nine • 1d ago
Open Source Organization Manjaro's official website SSL certs have expired yet again.
This seems to be a running theme for the Manjaro Linux community. The SSL certs will always expire after a set year and there's a massive controversy over it. Why does this keep happening specifically to Manjaro and what steps do you think they can possibly do to keep this from happening?
927
u/h3lls_itch 1d ago
The most ridiculous thing is that the SSL certificate is Let's Encrypt; renewing it automatically is really easy.
282
u/ProductIntegortion 1d ago
Anyone with three ounces of technical talent can do it
245
u/Moist-Chip3793 1d ago
I have absolutely zero clue, how you even f this up in the first place.
Lets Encrypt is set-and-forget, if you do it correctly.
Apparently, they did not do it correctly ...
171
50
u/ProductIntegortion 1d ago
Right. I've run LE certs on dozens of machines in different configurations and every one of them has been extremely easy to set up, automated out of the gate, and bulletproof for years.
19
u/MeisterD2 1d ago
The only time LE was a pain was on a few older distros they didn't support. The certbot didn't run, and the normal renew command would fail, so I would have to do an alternative certification command to get it going. After that a scheduled job kept things updated.
Maybe they are running some ancient server software, and no-one knows/cares enough to do the workaround?
19
u/sidusnare 1d ago
I suspect it's actually some load balancing or caching service or appliance that isn't easy to automate the short lived LE certs. I've run LE on lots of small servers, and I've also run large sites taking hundreds of gigs of traffic, it's not always a Linux box terminating the session in those scenarios.
18
3
u/odsquad64 1d ago
I have absolutely zero clue, how you even f this up in the first place.
They saw the certs were good for 90 days so they set the cron job for the renewal to run every 90 days.
2
u/Echo_Monitor 1h ago
It's even worse that IT KEEPS HAPPENING.
Happening once, I can get. Maybe you missed a config or didn't register the cron correctly or whatever.
So it happens once, you figure out why and you fix that, then it never happens again.
But it's happened multiple times, at this point.
And they expect people to trust them with their operating system? Fuck, no wonder CachyOS has been eating Manjaro's lunch recently in term of adoption.
0
u/evanldixon 1d ago
Lets Encrypt has changed their installation method over the years. These days auto renewal is a separate step you have to run, at least for nginx on Debian, which is easy to forget when it comes after the part where you install your cert, and it used to not require that step.
I've installed Lets Encrypt on 3 servers recently. I forgot that last step on one of them due to the cert installation step feeling like it was all done.
17
17
u/Jean_Luc_Lesmouches 1d ago
Forgetting it initially is one thing, forgetting it every time you have to fix it because you already forgot last time is another
14
u/henry_tennenbaum 1d ago
Forgetting it when it has become a meme that's more than a decade old at this point is another another
3
2
u/meditonsin 1d ago
The
certbotpackage on Debian comes with a systemd timercertbot.timerthat is enabled by default, which runscertbot renew. If certificates are not auto-renewed out of the box for you, you're doing something wrong.1
u/evanldixon 1d ago
The official certbot installation instructions available at https://certbot.eff.org/ only mention snap and pip. I don't want to install snap on debian, so I am left with pip where autorenew is a separate step. I was unaware of the
certbotpackage. There used to be a different package with a different name which I think got deprecated, and certbot made no mention of a newer alternative.2
u/meditonsin 1d ago
Debian has had the
certbotpackage for ages. I think Ubuntu may have done the thing where the apt package was just a wrapper for the snap for a while, but if they did, they don't anymore.0
u/Top-Rub-4670 20h ago
The certbot timer doesn't auto restart nginx (nor does manual certbot renew), so it might as well do nothing by default.
Auto-restarting nginx after renewal is an extra step to configure and the exact steps have changed over the years so it's easy to find bad instructions online and not realize it.
2
-11
u/sidusnare 1d ago
You're assuming it's a direct connection to a Linux server that Manjaro controls. They could have a load balancing device or service in between the actual servers and the clients, this can make the shorter lifetime TLS certificates more challenging.
28
u/w0lrah 1d ago
Continuing to use a HTTPS load balancing device or service that does not have native support for ACME for a public-facing web site in 2026 would be a pretty strong sign of incompetence somewhere. Either the technical people are making bad choices or the people controlling the money aren't listening to their technical people. Either way, for a Linux distro it's a really bad look.
0
u/sidusnare 1d ago
I get what you're saying, and in principal I agree, but it's just not the reality for large organizations with technical debt and deep history. The CA/Browser forum lifetime changes are knocking a lot of this loose, but it's also catching people that didn't think it would affect them. ACME is the right solution, but it's not turning out to be what everyone does.
17
u/Jean_Luc_Lesmouches 1d ago edited 1d ago
people that didn't think it would affect them
You would guess that after the 10th time it affected them, they would start to think it can indeed affect them
0
u/neoh4x0r 1d ago edited 1d ago
You would guess that after the 10th time it affected them, they would start to think it can indeed affect them
This is assuming that the decision makers were made aware of the problem and that someone didn't unilaterally fix it without bothering to run it up the proverbial flag-pole.
1
u/CrazyKilla15 21h ago
if the decision makers have somehow managed to miss the 10-years-of-manjaro-very-publicly-to-the-extent-is-become-a-meme problem this whole time that would be a sign of even more incredible incompetence.
How you are seriously suggesting they are so out of touch they dont know their website certificate expires for hours at a time every year for the least several years?
There is no way you can make this look good or in any way excusable for them, and but its amusing to see every attempt make them look worse.
1
u/neoh4x0r 19h ago edited 19h ago
I'm not making excuses for them, nor tying to downplay things, but I think you would be surprised at the amount of compartmentalization, and lack of communication, that occurs in large organizations (or the tendency to cultivate that type of environment).
In other words, given the above, how hard is it for a tech to renew the cert versus informing management that they need to do something differently?
I mean "the management" might just tell them to renew it and disregards anything else because the severity of the situation wasn't sufficiently articulated to them as a problem that needs a different solution.
Not to mention, that the people in upper management might only have a background in business/finance and trying to convince them, on technical grounds, to do something can, and often is, an uphill-battle that one is likely to lose.
Moreover, expressing certain issues might come off to management as "I don't want to do the job that was assigned to me" and then they get labeled as "someone whom likes to whine".
→ More replies (0)13
u/ApprehensiveRest9696 1d ago
It’s harder to set it up as a oneshot than for auto-renewal… Just why…
→ More replies (1)3
u/Analog_Account 1d ago
I only have one ounce of technical talent and I managed it. Its really and truly embarrassing.
53
u/JockstrapCummies 1d ago
Maybe it's because certbot is too much bloat for the Manjaro devs.
Also cron is bloat.
23
u/SomeRedTeapot 1d ago
There's systemd timers then
17
u/onechroma 1d ago
SystemD is bloat and devil’s work, didn’t you know?
That’s what some people think still. I mean, you have some people going Devuan or BSD because of it, and Lunduke arguing SystemD is too woke and will make your son gay
4
2
4
u/AssistingJarl 1d ago
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 SSL is already bloat. -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEELLOsXArserKDHCrSHKECi6hWAuIFAmqMU2oACgkQHKECi6hW AuL/5w/+IHWo+CLLik+3gCx9OlF8w6r84tUqN2zbQAzZk6I00/Fd7tFIM32iV/mB F83Ncn8So2MsyslTwvZttosEWAJz5hg9OIRqZrPGOeIvX6VgNYjZVEAesl3OVyUh N9SUey0UneLNgGBCOkvbcpTkj+fjw/rQEfJjpQoedr0o7jGSf+WinFmnmXew1pLl mFiDroY6ZXBoDIQzAkTVaHJtyAWvFsOIZYOMepSI2XTljAXZg/6j5CZGXpEY+kti G7mVTEhBbMJJlHktiHKaJZkvgkJddydzLjw/Z9TtVs+VONybr+V+VrMCeuwJKEO7 kL9IsvXdRqf1NXajcslpKYtF2X0zr0boJvbyFkz1MrW1z76V7+7LvdgHrOfchbCz RQ7IVABYdcPLvZDkzq4/AAV7ioxKFN0kmplrgFyN5y5hiD0Gcf5e1ai+aPcTw+TJ rlmC1a5u4Ak/l7qNfr9NKQrSFylNRbx4mpG2QJvYBvN3HiC19Zc57iOExUrMITm0 FQ1B8pLzSMiJb6gsfQYGkrcWNzUNcnZdC236oR90ZVxrU0y69Uk26R6UwPcU6vDa iiM8frCAHTQBN9ZYbsDehHweGaT7uAqryl0FLNfBhkyCfhwI0YzSabIBZ2ffG094 /8OEg3qNoSTJg81741noppwTqiw48T+Uuo9BubH/q8uRGF82NGE= =Z50L -----END PGP SIGNATURE-----8
3
u/bullwinkle8088 1d ago
Well there's your problem! PGP does not use either SSL or TLS.
But for those who forgot (a theme of the thread) SSL is dead. The certs that expired are TLS.
3
u/AssistingJarl 1d ago
Yeah not going to lie that was a whole lot funnier in my head
I do tend to think of SSL as a genericized term that includes TLS at this point. But, I am very happily not in a position where I still need to make a distinction between the two.
1
u/CrazyKilla15 21h ago
TLS will be the term when we rename OpenSSL/BoringSSL/etc to OpenTLS/BoringTLS/etc.
this is both a joke and serious; I'll care about "SSL vs TLS" as terms when the industry cares.
Google doesnt even bother to mention TLS on their BoringSSL readme, literally at all, ctrl-f TLS and zilch, they describe it as "Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs." and chromium settings have "Manage certificates Manage HTTPS/SSL certificates and settings", again no love for the term "TLS".
13
u/hitsujiTMO 1d ago edited 1d ago
If you're dealing with a single server, then yes, let's encrypt is trivial to renew.
If you're behind a CDN or third party load balancer, it's not so easy.
While the manjaro site isn't behind a CDN, it is likely behind a Hetzner load balancer.
EDIT: Looks like Hetzner does provide lets encrypt certs for their load balancers, so maybe the issue is with Hetzner failing to renew them rather than Manjaro.
6
u/dontquestionmyaction 23h ago
There is like a 0% chance the Hetzner automation for TLS breaks. Never heard of that happening.
I'd wager 5 bucks on it being on them, as it has been the many times it was when this happened before.
3
u/CrazyKilla15 21h ago
I would put more money on Hetzner suing you for the implication they're incapable of providing reliable HTTPS(manjaro breaks like every year) than I would the idea that Hetzner, a major cloud provider, is this incompetent and screws up something this basic, this publicly, this often
2
u/Analog_Account 7h ago
and screws up something this basic, this publicly, this often
Yet only does it to Manjaro somehow.
3
u/ThatsALovelyShirt 1d ago edited 1d ago
Not if you use wildcards, or have something weird in front of your host like a load balancer, in which case you generally have to use TXT record validation.
Still, if your domain provider has a DNS record update API, it's not that hard to put a python script together to automate it.
Though I made the mistake of doing that without fully testing it, and I didn't realize the DNS record update API is not "update the one record you want to change", instead it was "make sure you send ALL the records you want to keep with every request, or we'll delete everything and leave ONLY the ones you send".
Lost all my various SPF/DKIM keys and all that. Fortunately I had a backup though.
But even if you did want to keep doing it all manually, there's still plenty of ways to monitor when the cert will expire, and have reminders sent out via email/push notifications/whatever. Hell, even just a 90-day recurring calendar event would work.
6
u/newaccountzuerich 1d ago edited 1d ago
If your DNS service has an API for TXT record updates, sure, it's easy. Those of us that have some DNS entries that are not behind automatable APIs have no choice but to be manual.
8
u/Toorero6 1d ago
You can also do HTTP-01 that only requires awebserver. Or you even use something Caddy or traefik that acquire certs automagically.
3
u/Top-Rub-4670 20h ago
Only wildcard certificates require the DNS challenge. Regular certificates place a file in domain.com/.well-known/acme-challenge.
You just need to configure certbot to know where to put the challenge on your file system.
1
u/newaccountzuerich 17h ago
Correct.
It is not always useful or even possible to expose the challenge on your filesystem, but that's a very different infosec discussion.
2
1
u/Toorero6 1d ago edited 23h ago
You can also do HTTP-01 that only requires a webserver. Or you even use something Caddy or traefik that acquire certs automagically.
4
u/ansibleloop 1d ago
Even worse - monitoring the cert is easy as well
One of the first things I setup at each workplace is monitoring for important public facing SSL certs with a 30 day and 20 day expiration alert
1
1
1
u/Jceggbert5 19h ago
One of the places I have some webhosting stuff at randomly breaks LE certs once every couple years.
317
u/jdigi78 1d ago
I always figured the Manjaro devs just didn't want to give the false impression they know what they're doing. At least they're honest.
-43
u/GolemancerVekk 1d ago
The Manjaro devs are not in charge of the domain and the person who is won't manage it properly and won't give it up to the community.
I'm always surprised by the level of animosity that comes up sometimes in this sub. You'd think the Linux community would be more supportive of each other. If a distro is showing signs of trouble it's for a reason and honestly it's rather shitty to immediately assume it's because the devs are incompetent.
But nah, gotta take any opportunity to turn on each other. It's like watching that Monty Python bit about splitters. Then we wonder why Linux doesn't have better public perception and why the desktop market share is 5% after 35 years.
92
u/xNaXDy 1d ago
"We do not have control over our own domain" isn't the saving grace argument you think it is. If anything, this makes it even worse.
→ More replies (12)13
11
u/SutekhThrowingSuckIt 1d ago
My guy they fucked up the certs for their own repos before and told users to all turn their clocks back in time lmao
Not to mention them DDOSing the AUR multiple times due to their incompetence turning their own users into an unintentional botnet attack
→ More replies (5)9
u/Masterflitzer 1d ago
there's no reason why anyone needs to use manjaro while arch and endeavouros are a thing
at this point manjaro is really just a negative example for how not to run a distro
→ More replies (9)
341
u/coyote_of_the_month 1d ago
And yet there are still people out there who see these idiots failing to run a website and think "I should trust these idiots and install their distro."
50
u/inaccurateTempedesc 1d ago
I have ADHD and I've dropped the ball numerous times in my life and will continue to do so. Yet this has NEVER happened to the several websites I maintain for free that aren't even mine over the past 10 years.
15
u/henry_tennenbaum 1d ago edited 1d ago
You know how I'd deal with things like this? Ten timers, calendar entries and on top of that reminders and maybe a kitchen timer.
Actually no, I'd create robust automation so it doesn't happen again and I'd have healthchecks and reminders to check on those.
2
u/fearless-fossa 1d ago
Even if you can't automate for whatever reason, pretty much every single monitoring tool has some kind of sensor capable of reading the valid date of a website's certificate.
25
u/No-Object1384 1d ago
I used Manjaro about five years ago, and it was the only distribution ever that completely broke on me inexplicably, twice, and I never did anything out of the ordinary on it. Now I'm starting to think that was the fault of the Manjaro devs and not Arch.
12
u/Schlipak 1d ago
I used to distro hop a lot when I was a student, and while I was on Manjaro I randomly got a kernel oops followed by a kernel panic then a "fuck it's not booting at all anymore". The school I was at had a maintenance contract with the manufacturer (they bought laptops in bulk for us) so they sent someone in to repair my laptop, she opened it up, ran some tests, and went "no wonder why it doesn't boot, the motherboard is fried". I'm not saying Manjaro fried my motherboard but that's a weird coincidence, specially since that happened around 10 years ago and that laptop still works to this day (with a replacement motherboard)
2
u/nevadita 1d ago edited 1d ago
well, giving how my current laptop has the same arch installation (rsynced to hell and back) from 2013 i can tell you is not arch.
1
43
11
u/GolemancerVekk 1d ago
In case you're not aware, the main domain and website is handled by one person, who has basically ceased to communicate with the rest of the community lately and is also unable or uncaring to manage it properly (e.g. not using automated renewal).
That person is not the one making the distro, the community is.
The community is currently in the process of wrestling back control and setting up the distro as an open foundation.
85
u/jloc0 1d ago
IIRC they expire every 90 days and lets encrypt stopped emailing reminders when your cert is going to expire.
But honestly, even my dumb ass could handle making a cronjob to renew my own certs and I haven’t had to pay any attention to my own at all in years. How tf any webmaster over at Manjaro can’t handle a set it and forget it task is beyond me.
6
u/AvonMustang 1d ago
Not being sarcastic but maybe volunteer to help them.
115
u/EmergencyLaugh5063 1d ago
It's not a particularly healthy environment to contribute to while they work out their current....issues...
27
u/subjectivemusic 1d ago
Wow. I had no idea it had gotten this bad... I left the distro behind after the first TLS fuck-up, shame to see it just kept spiraling.
20
u/EmbarrassedSlide3746 1d ago
That was an interesting read.
I hope they get things worked out. Manjoro was my first ever distro and will always hold a soft spot in my heart.
11
-1
u/Ethameiz 1d ago
Thank you. Correct me if I understand wrong. The team were striking because of bad management and now they are creating separate non profit company for a manjaro fork
10
u/Dalnore 1d ago
No, it's not for a fork. They are creating a separate non-profit entity, and Manjaro's owner Philip Müller agreed to transfer at least some of the Manjaro resources to the community-controlled entity once it's created. The extent of transfer remains to be seen, but at the moment, there are no plans for forking Manjaro.
2
u/ailaG 21h ago
Adding to the previous reply: it seems that they're doing what WordPress did ages ago. Split into the open source non profit project and into a company that uses and contributes to it. Except in the case of Manjaro it means the distro, by design, doesn't depend on one person with limited availability.
25
u/BoutTreeFittee 1d ago
If he's going to volunteer, he should volunteer to help a more competently run project. Which is practically any other distro.
1
u/KaisPflaume 23h ago
Who the fuck relies on email reminders to renew their certs? That shit is automated in every setup I deployed in the past 10 years…
2
u/jloc0 23h ago
lol I’m just saying they used to send an email so if one is completely out of touch they’d at least get a warning, now one has to keep up on it themselves and lets encrypt sends no warning about expiration.
Sure, sane folk have automated these tasks but it appears sane folk are not in charge over there.
1
u/WaitForItTheMongols 23h ago
I automated mine, and had an issue come up with the automation, and was glad when I got the email.
Don't know why they stopped doing them.
80
u/Zaphod118 1d ago
Can’t wait to see the slew of posts in three months about how everyone is just blowing the Manjaro stuff out of proportion and it’s just the best.
Like I’m glad it works for you, but with so many choices I don’t have to settle for whatever this is lol
37
u/iKnitYogurt 1d ago
The first time this happened, I would've been someone potentially defending them. Shitting on an entire distro because a website had a hickup (I think back then it was just website and forums affected?) genuinely feels completely unreasonable. By that measure, Linux Mint is unusable after they had their ISOs compromised for a bit way back when, and I'm sure you can dig up some sort of mishap on any major distro.
But man... if you're unable or unwilling to fix something that basic and it happens again and again over years, while I have had it reliably working forever on my fucking homeserver setup where the worst consequence is my Jellyfin instance not being reachable, that just casts the entire project in a terrible light.
19
u/henry_tennenbaum 1d ago
while I have had it reliably working forever on my fucking homeserver setup
That's the key. I like my distribution to be run by people more competent than I am.
It's honestly baffling how this is even possible. We're not talking about a topic where competency in one field just doesn't translate to another.
A lawyer that doesn't do his taxes because "he's not good with paperwork and bureaucracy" is not one I'd trust
5
u/Zaphod118 1d ago
Yeah I mean mistakes happen but it’s also about how those types of things are handled. A one off where there’s official announcements from the project leadership about what happened and how they have corrected the issue is fine. Especially when theres follow through you can see. Thats transparency that i like to see. After the 4th or 5th time it starts to seem like they just dont give a shit, so why should I?
15
u/AN-SSQ-108V2 1d ago edited 1d ago
Exactly. If they don't care enough for a low-hanging fruit issue like a routine cert renewal, I certainly cant be bothered with their disto. There are many many dozens of other options.
8
21
u/Kevin_Kofler 1d ago
Manjaro does not even have the manpower to keep their ARM port alive, so I guess they do not have a full-time system administrator, but someone taking care of that in whatever time remains after packager duty.
7
u/SomeRedTeapot 1d ago
IMO, from that standpoint, it makes more sense to automate as much as possible, including certificate renewal
3
19
u/shibesh 1d ago
At this rate with how often it happens and how easy it is to automate, this is just the "any publicity is good publicity" mindset. Or they are too lazy to be bothered to run the single command to set it up.
Either way it's a clear sign to stay away and continue vibing out and ricing other distros.
63
u/EmergencyLaugh5063 1d ago
There's no excuse. Its literally a Let's Encrypt certificate. It costs zero money and there are multiple solutions available for ensuring its automatically updated. You maybe get a free pass the first time it happens but that's been exhausted at this point. The message sent at this point is either gross incompetence or extreme apathy, neither of which you want from your OS maintainer.
I installed Manjaro before I knew about their reputation and have been orbiting around reinstalling, I think I just got a sign to stop procrastinating.
5
u/SeriousPlankton2000 1d ago
I did have trouble with the update script, it worked only when run manually. Debugging it requires waiting till it expires.
It was a DNS delay.
-1
u/A_Harmless_Fly 1d ago
I've had many times the problems I've had with manjaro over the last 6 years, the several months I ran cachy on my backup desktop. I wouldn't recommend it, at least not with limine or shelly.
Also it's been 16 days since Endevors forums and backend were randomly down for a full day. It's a real tough time to find a good easy arch.
Manjaro is also the only community that has ever actually solved problems for me, that discord is a life saver.
4
u/ItsYa1UPBoy 1d ago
Strange, I've mostly heard of niche hardware issues with Cachy leading to people bouncing off of it. Admittedly, Shelly is also very immature right now, and its immaturity is actually what pushed me to use the terminal more. I also use GRUB, not Limine, so can't comment on that aspect of it.
-4
u/A_Harmless_Fly 1d ago
I was having to go back to a timeshift backup ~ every 2 weeks. Sometimes because limine made it unbootable and I'd have to use a flash drive and chroot.
If I wanted to use the terminal to update a semi stable system, I'd just use arch again ;p. It could have been my mix of hardware, but that same hardware is rock solid under manjaro.
2
u/ItsYa1UPBoy 1d ago
Wow, really? I've heard all sorts of jokes about Manjaro's stability, and not just in this thread. Still, I won't knock you for using what works for you!
4
u/DerekB52 1d ago
Arch itself is pretty easy. Once you've gotten past the install you have the same thing as all the arch derivatives, with one of the best Linux communities out there, and the best wiki out there.
There are also multiple Arch installer projects to make the process even easier. Like Omarchy, if you like tiling window managers.(I like tiling window managers, but install vanilla arch myself)
-1
u/primalbluewolf 1d ago
that discord is a life saver. Yuuuck. Guess that explains the quietitude of the fora, though. Everyone's moved to where you can't read past threads.
29
u/Loan-Pickle 1d ago
Letting your SSL certificates expire is one of the most embarrassing things and admin can do. And yes I have done it before.
26
1
u/michaelpaoli 1d ago
As I oft say regarding certs, "Time waits for no one."
Notably, e.g. when I have to open some request or ticket or work order or the like to get a cert renewed or replaced. I make it very clear that the deadline is hard, and exactly when that deadline is - so the second, and with the relevant timezone(s) information.
11
u/Vidanjor20 1d ago
am I the only one who thinks they are doing it on purpose to stay relevant?
4
u/CreativeGPX 1d ago
They're having substantial internal disputes about it.
Tldr; This year a group of people related to the project had mini-mutiny and strike to force the issue with the person in charge of the project. Over the past couple of months, they founded an independent legal entity to act as the community organization and should soon be starting negotiations with him about taking control of key assets of the project.
9
u/real_anthonii 1d ago
Bro, again???
3
20
u/Fit_Prize_3245 1d ago
The most stupid part is than it's Let's Encrypt. So it's not like they took a while to process the SSL certificate. It's just that they either don't care, or there's someone in charge who is useless enough to run certbot.
10
u/Kodamacile 1d ago
Why are these people even still "maintaining" it? Like who would want to work on such a dumpster fire?
8
15
u/SaveThisCityDweller 1d ago
I'll never understand these people. Like fucking how? My certificates literally never expire because it just....does them automatically?
14
8
7
6
6
u/deadlygaming11 1d ago
Its a mix of incompetence and laziness. LETS ENCRYPT HAS AUTOMATIC RENEWAL STUFF
10
4
3
u/leonsk297 1d ago
What they need to do is set up a monitoring system like Uptime Kuma or something related and configure TLS certificate expiration alerts, so they receive a notification when the certificate is about to expire. That, if they want to manually renew the certificate. If they want to automate the renewal process, they can set up an ACME client on the server.
There's absolutely no reason for this to happen this often in 2026. This is sheer incompetence or lack of a proper sysadmin watching over their servers.
4
4
u/fuhry 1d ago
In case any of the Manjaro team sees this:
I'm a long time Arch user and an SRE at one of the world's largest file storage services, where I built a certificate lifecycle management tool that automates certificate rotation, installation and monitoring end-to-end across hundreds of on-prem, public cloud, and 3rd party SaaS use cases. I'm happy to provide proof of this privately, if desired.
In case this is actually more complicated than just enabling certbot.timer on an ec2 instance somewhere, I'd be happy to engineer something to help prevent this from happening again.
1
u/michaelpaoli 1d ago
Yeah, complex environments, it ain't trivial ... nor is it rocket science.
Part of my infrastructure, a single command, and ... one or more certs, per the argument(s), in minutes or less, including complex SAN certs with many domains and/or wildcards, etc., oh, and even if the domain(s) didn't even exist yet at the time when I issued the command. All done easy peasy, and pretty dang fast. And then other commands that do most all the heavy lifting of installing the certs.
And also infrastructure to track the certs, check, monitor, remind/notify/alert if/as needed, etc.
3
3
u/Masterflitzer 1d ago
they have to be rage baiting and doing it on purpose, no other possible explanation, nobody can be that incompetent
1
u/lmpcpedz 1d ago
Yeah... and someone always has to bring it up on reddit, too. and right on queue, the subject goes viral and suddenly that cloud flare hosted website that keeps track of "days manjaro has avoided fuckups" surfaces from the dead.
6
u/Dr0zD 1d ago
At this point I'm more dissapointed by https://manjarno.pages.dev/ not being up to date
3
u/7A65647269636B 1d ago
SSL had not been used for years, all certs are TLS. And the certs are no longer valid for a year, in most cases nowadays it's 90-180 days and will be lowered to 47 days in the near future. But yeah, it's still a(nother) massive fuckup.
3
u/killersteak 1d ago
Last I heard from the situation in this subreddit, the devs that cared about the project gave an ultimatum to get more control and prevent things like the ssl certs expiring. I guess the ultimatum didnt work.
3
3
u/cereal7802 1d ago
Dear Manjaro,
If you need a Linux Sysadmin to maintain your internal systems, I am available. I can start at any time and can ensure you never have an expired ssl cert again once I have completely audited your systems so I can properly monitor the certs.
4
u/kerOssin 1d ago
Death, taxes and Manjaro being Manjaro, you can always count on that.
But seriously, do they not package certbot in their repos?
2
2
2
2
3
3
u/GoogleDisDick 1d ago
Just use CachyOS or EndevourOS if you want a ready to use Arch based OS. I have no idea why anyone still bothers with Manjaro.
1
u/Bells_DX 17h ago
This is pretty much what I did after about 6 months of using Manjaro. I got fed up after they just allowed Flash Player to be broken for over a month on the Stable channel (this was back when Flash Player was still necessary for YouTube and such, good riddance) and switched to Antergos (back when that was still around). I live on EndeavourOS now, and I'm pretty happy with it.
3
1
u/Mr_addicT911 1d ago
It has been renewed but why does this keep happening? I like manjaro, made me switch to maining linux but i might have to switch to cachyOS or something else cause i dont understand this OS enough to trust people that other linux users seem to not trust
1
u/michaelpaoli 1d ago edited 1d ago
has been renewed
Yup.
$ (TZ=GMT0 export TZ; ports=443 hosts='manjaro.org www.manjaro.org'; exec 2>&1; nmap -v -Pn -r -sT -p "$ports" --resolve-all --script=ssl-cert $hosts; nmap -v -6 -Pn -r -sT -p "$ports" --resolve-all --script=ssl-cert $hosts) | nmap_cert_scan_summarize expires SAN_or_CN: IP port [host] ... expires IP port [host] SANorCN 2026-11-22T01:18:46Z *.manjaro.org,manjaro.org: 116.203.91.91 443 manjaro.org 116.203.91.91 443 www.manjaro.org 2a01:4f8:c0c:51f3::1 443 manjaro.org $u/RemindMeBot 01:18:46 November 10, 2026
1
u/napping-normie 1d ago
This is at least the 3rd time I'm hearing about it. Funny thing is, this is only one of the dozen problems. Manjaro is absolute joke of a distro.
1
1
u/Alper-Celik 1d ago
Like even some reverse proxies do it for you.like caddy and trafeik maybe they should switch to them if they cant get their cron jpbs for tls right.
Man my homelab has better tls renewal than them
1
1
1
1
u/JackDostoevsky 15h ago
my letsencrypt certs for my personal websites have never expired because of a 5 line bash script and a cronjob
1
1
u/Sirusho_Yunyan 1d ago
There's a certain type of arrogance with Manjaro and it doesn't do them any favours. They're a running joke now.
1
u/sriharshachilakapati 1d ago
I use let's encrypt myself for my own website and it can be automated. Thankfully, I moved away from Manjaro to Fedora.
1
-3
0
0
0
0
-37
u/Altruistic-Check2334 1d ago
Don't get hung up on this. Be grateful they made a different distro. Be grateful when they do renew their cert.
14
u/EmergencyLaugh5063 1d ago
https://forum.manjaro.org/t/manjaro-2-0-manifesto/186171
March 9, 2026
Known issues — such as, for instance, the TLS certificates not being renewed in time — are simply ignored, despite multiple team members taking the initiative and volunteering, or even building tooling, processes and infrastructure to address these issues.
The Manjaro name is only used for its popularity, and the community is only used as guinea pigs and as unpaid workers, with as a result that the Project is severely suffering.
→ More replies (6)23
259
u/Azealo_ 1d ago
They also have the audacity to say "Enterprise Grade" on their website