Boulder: Clarify expiration-mailer unsubscribe link warning text

[cpu]

As a follow-up to https://github.com/letsencrypt/boulder/pull/2404 we received feedback from (@runephilosof ) that the warning for the unsubscribe link should make it clear that it is for all domains with wording similar to:

If you want to stop receiving all email (not only regarding the domains above) from this address, click

[gregsadetsky]

Small note that the "certificate expiration notice" email does not presently include this notice. It has:

If you are receiving this email in error, unsubscribe at <link>

I also clicked this link "by mistake", wanting to unsubscribe from expiration notifications for one, not all domains.

Thanks!

[beautifulentropy]

The boulder team has created an internal SRE ticket to track this change. Now closing this issue.

[beautifulentropy]

The fix for this was deployed to production yesterday 🥳

[githubjsorg]

Small note that the "certificate expiration notice" email does not presently include this notice. It has:

If you are receiving this email in error, unsubscribe at <link>

I also clicked this link "by mistake", wanting to unsubscribe from expiration notifications for one, not all domains.

Thanks!

Same here. How do I re-subscribe to expiration notices for my other domains?

[jprenken]

Hi @githubjsorg,

You will need to change the e-mail address for your ACME registration. For example, using Certbot, you can run: certbot register --update-registration

[githubjsorg]

Hi @githubjsorg,

You will need to change the e-mail address for your ACME registration. For example, using Certbot, you can run: certbot register --update-registration

So I have to do this on ALL the certs I have? And this will work by just giving it my email again? That will override the unsubscribe?

[jprenken]

So I have to do this on ALL the certs I have? And this will work by just giving it my email again? That will override the unsubscribe?

You would need to do this for every ACME registration (account), rather than every certificate. But, you'll need to use a new e-mail address. There currently is no way to re-subscribe an unsubscribed address.

[githubjsorg]

So if I don't have another address to use, I am screwed?

[jprenken]

I'm sorry to confirm that we don't have an easy solution for re-subscribing an address after its unsubscribe link has been used. We're aware of it and keep thinking about it (like in this issue), but haven't yet had time to build a structure to fully handle this edge case.

[githubjsorg]

How do I help fix this bug so that addresses can be removed from the unsubscribe list? This is a critical issue for me as I need to be re-subscribed to the notices for the rest of my domains.

[jprenken]

Most of the time/effort involved in this fix will be with updating LE's organizational processes, controls around subscriber data, integration with external e-mail service providers, etc. Because there is no ETR, you may want to set up an e-mail alias or second account to work around this.