BBS now warns you when the SSL certificate is not renewing, and a server upgrade waits for running jobs instead of refusing.
Certificate expiry warnings
Let's Encrypt stopped sending expiry emails in June 2025, so nothing told anyone a renewal had stalled until a browser warning did. On a BBS install that is worse than it sounds: agents check in over the same certificate, so an expired certificate stops backups everywhere, not just the admin page.
BBS now checks once a day and raises its own alert when the certificate should have renewed and has not — at 29, 14 and 7 days remaining as warnings, then 3, 2 and 1 days as critical, plus one at expiry itself. Each alert goes to the bell, email, Apprise and the push service, with its own toggle in each place, on by default.
The message says why renewal is stalled when that can be known: no renewal timer is scheduled, the certificate is self-signed, or certbot's own last error — "DNS problem: NXDOMAIN looking up A for …" tells you what to fix.
Installs with no certificate of their own — behind a proxy that terminates TLS elsewhere — stay silent.
Server upgrades wait for the queue
Requesting an upgrade while backups were running was refused, leaving you to watch the queue and try again. Now the queue is suspended first (maintenance mode), then running jobs are counted — in that order, so nothing can slip in between the check and the suspension. If jobs are still running, the upgrade waits and starts on its own once they finish, with a final re-check before it does. Cancelling the wait puts maintenance mode back as it was.
Also available over the API: POST /api/v1/updates/upgrade-server starts an upgrade to the latest release, and DELETE on the same path cancels a waiting one.
More specific push notifications
Notifications from the push service now name what happened and where — "Backup failed on web-prod-01: plan "System Backup" did not complete" rather than "A backup failed" — and carry a link to the job, client or page they are about.
Smaller things
GET /api/v1/sslreturns the Let's Encrypt contact address alongside the certificate status; it could previously be written but not read.- The SSL settings page no longer describes that address as where expiry warnings come from, since Let's Encrypt stopped sending them; BBS's own warnings replace that.