Mapper.ntppool.org cert expired

Pool Development
1

I’m not sure if there is a better place to report this.
The TLS certificate for mapper.ntppool.org expired Aug 24th, 2025.

Screenshot 2025-08-26 at 11.07.17 AM
Screenshot 2025-08-26 at 11.07.17 AM972×548 55.7 KB

2

Doh, fixing it now. (And I need to make the alert for this more insistent / prominent!)

3

Too bad the name servers for mapper.ntppool.org (m1.ntpppool.org and m2.ntppool.org) only have IPv4 addresses and no AAAA records.

Is there a specific reason for that?

1 Like
4

He has to pay extra for AAAA instead of one A :rofl:

1 Like
5

Hi @ask, www.mapper.ntppool.org cert has expired again.

2 Likes
6

Scott Aerators said: Certificate expiration issues can sometimes go unnoticed until they affect a specific service or connection. Keeping certificates monitored and renewed before the expiration date is a simple way to avoid unexpected interruptions.

The pool GeoDNS is not alone in deciding where a request is handled
7

Oof – we’re just getting finishing getting monitoring bits properly in order since the infrastructure move in the spring; but really this should have been setup better long ago! I will see if @gfk or @MagicNTP can help fix it better than I’ve done. :slight_smile:

8

This shouldn’t be a problem anymore, as we’ve received a generous sponsorship from the SSLMate Cert Spotter service.

A bit of backstory: I’ve been using SSLMate’s Cert Spotter at my day job since they started offering that service. Over the years, Andrew Ayer, who runs SSLMate, has always been very responsive, and a few times he even added features after we discussed our needs with him. So when the certificate expiry problem came up here, I thought of contacting him. I wrote to ask whether SSLMate would consider sponsoring the project, and he immediately offered a free Cert Spotter subscription for the pool’s domains.

It’s now set up: it watches Certificate Transparency logs for our domains, checks the certificates we actually serve, and sends expiry alerts to several volunteers, so a failed renewal shouldn’t go unnoticed again. It’ll also come in handy as we’re in the process of rolling out authoritative DNS over TLS (ADoT) on the name servers, which adds more certificates to keep track of.

Thank you, Andrew and SSLMate, for the generous support!

4 Likes