{"action":"created","issue":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/2097","repository_url":"https://api.github.com/repos/letsencrypt/boulder","labels_url":"https://api.github.com/repos/letsencrypt/boulder/issues/2097/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/boulder/issues/2097/comments","events_url":"https://api.github.com/repos/letsencrypt/boulder/issues/2097/events","html_url":"https://github.com/letsencrypt/boulder/issues/2097","id":168533578,"number":2097,"title":"Expiration notice sent for renewed certificate","user":{"login":"patf","id":277794,"avatar_url":"https://avatars.githubusercontent.com/u/277794?v=3","gravatar_id":"","url":"https://api.github.com/users/patf","html_url":"https://github.com/patf","followers_url":"https://api.github.com/users/patf/followers","following_url":"https://api.github.com/users/patf/following{/other_user}","gists_url":"https://api.github.com/users/patf/gists{/gist_id}","starred_url":"https://api.github.com/users/patf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/patf/subscriptions","organizations_url":"https://api.github.com/users/patf/orgs","repos_url":"https://api.github.com/users/patf/repos","events_url":"https://api.github.com/users/patf/events{/privacy}","received_events_url":"https://api.github.com/users/patf/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/area/tools","name":"area/tools","color":"4B7C8C"},{"url":"https://api.github.com/repos/letsencrypt/boulder/labels/kind/bug","name":"kind/bug","color":"7F5195"}],"state":"closed","locked":false,"assignee":{"login":"cpu","id":292650,"avatar_url":"https://avatars.githubusercontent.com/u/292650?v=3","gravatar_id":"","url":"https://api.github.com/users/cpu","html_url":"https://github.com/cpu","followers_url":"https://api.github.com/users/cpu/followers","following_url":"https://api.github.com/users/cpu/following{/other_user}","gists_url":"https://api.github.com/users/cpu/gists{/gist_id}","starred_url":"https://api.github.com/users/cpu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpu/subscriptions","organizations_url":"https://api.github.com/users/cpu/orgs","repos_url":"https://api.github.com/users/cpu/repos","events_url":"https://api.github.com/users/cpu/events{/privacy}","received_events_url":"https://api.github.com/users/cpu/received_events","type":"User","site_admin":false},"assignees":[{"login":"cpu","id":292650,"avatar_url":"https://avatars.githubusercontent.com/u/292650?v=3","gravatar_id":"","url":"https://api.github.com/users/cpu","html_url":"https://github.com/cpu","followers_url":"https://api.github.com/users/cpu/followers","following_url":"https://api.github.com/users/cpu/following{/other_user}","gists_url":"https://api.github.com/users/cpu/gists{/gist_id}","starred_url":"https://api.github.com/users/cpu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpu/subscriptions","organizations_url":"https://api.github.com/users/cpu/orgs","repos_url":"https://api.github.com/users/cpu/repos","events_url":"https://api.github.com/users/cpu/events{/privacy}","received_events_url":"https://api.github.com/users/cpu/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/letsencrypt/boulder/milestones/45","html_url":"https://github.com/letsencrypt/boulder/milestones/Sprint%202016-08-09","labels_url":"https://api.github.com/repos/letsencrypt/boulder/milestones/45/labels","id":1933173,"number":45,"title":"Sprint 2016-08-09","description":"","creator":{"login":"jsha","id":220205,"avatar_url":"https://avatars.githubusercontent.com/u/220205?v=3","gravatar_id":"","url":"https://api.github.com/users/jsha","html_url":"https://github.com/jsha","followers_url":"https://api.github.com/users/jsha/followers","following_url":"https://api.github.com/users/jsha/following{/other_user}","gists_url":"https://api.github.com/users/jsha/gists{/gist_id}","starred_url":"https://api.github.com/users/jsha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsha/subscriptions","organizations_url":"https://api.github.com/users/jsha/orgs","repos_url":"https://api.github.com/users/jsha/repos","events_url":"https://api.github.com/users/jsha/events{/privacy}","received_events_url":"https://api.github.com/users/jsha/received_events","type":"User","site_admin":false},"open_issues":6,"closed_issues":1,"state":"open","created_at":"2016-08-09T18:02:55Z","updated_at":"2016-08-09T19:27:12Z","due_on":"2016-08-16T00:00:00Z","closed_at":null},"comments":3,"created_at":"2016-07-31T19:22:02Z","updated_at":"2016-08-09T19:27:12Z","closed_at":"2016-08-09T19:27:12Z","body":"Originally reported here: https://community.letsencrypt.org/t/expiration-email/18462?u=pfg\r\n\r\nThe user received a 10-day nag on July 23rd, for [this certificate](https://crt.sh/?id=18036716). However, the certificate [was renewed on July 7th](https://crt.sh/?id=24111321).\r\n\r\nThe FQDNs on both certificates are a perfect match. The only obvious difference between the two certs is the CN field, but that shouldn't have any effect on `setHash`."},"comment":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/comments/238663561","html_url":"https://github.com/letsencrypt/boulder/issues/2097#issuecomment-238663561","issue_url":"https://api.github.com/repos/letsencrypt/boulder/issues/2097","id":238663561,"user":{"login":"cpu","id":292650,"avatar_url":"https://avatars.githubusercontent.com/u/292650?v=3","gravatar_id":"","url":"https://api.github.com/users/cpu","html_url":"https://github.com/cpu","followers_url":"https://api.github.com/users/cpu/followers","following_url":"https://api.github.com/users/cpu/following{/other_user}","gists_url":"https://api.github.com/users/cpu/gists{/gist_id}","starred_url":"https://api.github.com/users/cpu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpu/subscriptions","organizations_url":"https://api.github.com/users/cpu/orgs","repos_url":"https://api.github.com/users/cpu/repos","events_url":"https://api.github.com/users/cpu/events{/privacy}","received_events_url":"https://api.github.com/users/cpu/received_events","type":"User","site_admin":false},"created_at":"2016-08-09T19:27:12Z","updated_at":"2016-08-09T19:27:12Z","body":"Closing this as **can't reproduce**. I'll keep an eye out for any other errant expiration mails for already renewed certificates being reported. Hopefully if it occurs again we can glean some additional information by having two instances of the bug to compare with. \r\n\r\nThe following are my repro-notes for :sparkles: future @cpu :sparkles: in the event the bug does reoccur.\r\n\r\n## Repro Notes\r\nI recreated the conditions (as best I can guess at them without more information) for #2097 locally with a fresh DB using the JS ACME client & mail-test-srv. Unfortunately I wasn't able to recreate the errant notification mail.\r\n\r\nI shrunk the time scale down and configured `ca.json` to issue certs with `\"expiry\": \"24\"`. To simplify things I also changed to `\"backdate\":\"0h\"` to disable backdating. I made a one-off `expiration-mailer` config file that set up a `12h` and a `22h` expiration nags and a `1h` `nagCheckInterval`.\r\n\r\nUsing the test client I issued one cert with `CN: www.example.com, SANS: www.example.com, example.com`, expiring in 24hrs. I ran the expiration mailer and as expected it found 0 certificates to process for nags the issued test cert had an expiry in 24 hours not 23 (_note_: the check is 23 hours not 22 hours as in the config because it is offset by the nagCheckInterval).\r\n\r\nI waited 45 minutes (close to the point that a nag should be sent for the first test cert) and issued one \"renewal\" cert with `CN: example.com, SANS: example.com, www.example.com`. Since the FQDN set matches the initial cert the expected behaviour would be to **not** send a nag mail, while the bug behaviour **would** send a nag mail. \r\n\r\nWhen I ran the expiration mailer it found 1 certificate to process, but generated zero nags. This is the expected behaviour since `processCerts` would discard the 1 found certificate since it has already been renewed. Checking the database both certs have a last nag date of 0. The test mail server received a connection from the expiration mailer but received zero `MAIL` commands.\r\n\r\n\r\n![it is a mystery :ghost:](http://i1.kym-cdn.com/photos/images/newsfeed/001/029/129/650.gif)"}}
{"actor":{"display_login":"cpu"}}