First start, will it find past renewals?

[schildbach]

I'd like to check if I've set certspotter up correctly.

Am I right in my thinking that on first start, it should find all my past certificate renewals and send mails accordingly?

[AGWA]

Yes - by default, certspotter will find and alert about previously-issued but not yet expired certificates. (It may also find some, but not all, expired certificates.)

Note that it's going to take weeks to months to find them so you may be better off specifying the -start_at_end option (which will start monitoring logs from the end) and then request a new certificate for one of your domains to test that it's working.

[schildbach]

Thanks for your answer. Is there some way to know how far in the timeline certspotter has gotten, or an estinated time to go?

During the last 2 days, it has found several certs from 2017 and just now it has found one from early 2023, but there should be plenty of certs inbetween.

If I decide to switch to -start_at_end, do I need to empty the data dir for the option to come to effect?

[AGWA]

Here's a shell script that prints how far certspotter is in each each log (it requires $CERTSPOTTER_STATE_DIR to be set to the path to your state directory):

#!/bin/sh

for logdir in $CERTSPOTTER_STATE_DIR/logs/*
do
        logid=$(basename "$logdir")
        position=$(jq -r .download_position.size "$logdir/state.json")
        largest_unverified_sth=$(find "$logdir/unverified_sths" -type f -print | sort -rn | head -n1)
        if [ -z "$largest_unverified_sth" ]
        then
                size=$position
        else
                size=$(jq -r .tree_size "$largest_unverified_sth")
        fi
        echo "$logid: $position out of $size"
done

See #79 for a builtin way to expose this information.

Note that certificates are contained in multiple logs, and certspotter scans them in parallel. Thus, it will not discover certificates in chronological order. Also, certspotter can't guarantee detection of all expired certificates, since logs get retried after all of the certificates in them are expired.

If you want to switch to -start_at_end, you will indeed need to empty the state directory.

[schildbach]

Thanks. For the records, I added a percentage to the last echo command:

echo "$logid: $(( $position*100/$size ))%, $position out of $size"

Now I'm wondering how to best get a date per log, assuming that at least each log is roughly ordered chronologically.

[AGWA]

You can look up the log ID in the log list (warning: in the log list, log IDs are encoded with normal base64, but in the state directory the log ID uses base64url) to get the log's temporal_interval, which is the range of certificate expiration dates present in the log. Some logs do not have a temporal_interval, which means they can contain certificates with any expiration date.