SimonHooker

Hi there, I'm one of the developers that works on My School Portal. If this still a problem, please could you reach out to support (again?) and hopefully there's something we can do to help. An alternative is to provision the certificate using a trusted authority however that presents other issues typically, such as having to expose the FQDN which typically is internal-only.

Within My School Portal you can schedule the emails ahead of time. If you're looking for an email to be sent on a recurring schedule, I'd suggest raising it through your account manager/support as it sounds like a decent improvement

It might be worth holding out if viable - the 3xxx series are released on September 17th - might be the 2xxx series come down in price a bit ( maybe wishful thinking though )

I'm a developer for a SaaS product which interacts with a lot of the functionality of most MISs, and frankly the idea of making a homemade MIS would be a daunting task. Whilst things like AWS make delivering a reliable service far simpler than it used to be, there's still a lot of complexity that just isn't apparent in every day use. Factor in the fact that schools all seem to want to do things a little bit differently, and you're asking for a headache. It's not impossible, but at the same time it's not trivial. Ultimately it's just cheaper to make use of an existing MIS unless you really have enough IT budget to hire a few developers, a QA team, support team, someone to manage it etc. As already mentioned, I am aware that iSAMS started this way however to get from where it started to where it is today has taken 15 years, and it's still being refined. I'm not envious of the task of making and running an MIS!

As barnabythebear mentioned it looks like a certificate issue in that the CN of the mailserver doesn't match the CN it's provided. The IP specified appears to be a Microsoft IP, so it's odd that it is returning an ip certificate instead of a properly named one. Might there be something intercepting the traffic + issuing its own certificate i.e. a firewall?

I also make use of AWS for most of my hosting now, but the sites I've had to find hosts for lately have been static sites meaning I can just make use of S3 with Cloudfront in front to serve it cheaply. Lightsail can be a bit pricier than some alternatives but it is nice and easy to get started on, takes a lot of the pain out of getting started.

We used to use one of these affected certificates and got reports of this issue from some schools - this is the announcement covering it, https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020 In the end I just swapped out the old certificates for Amazon-issued certificates to resolve the issue. In our case we made no changes due to the indication that the old certificates should still function correctly, however that was based on faulty assumptions hence us updating our certificates. Hopefully these other services do likewise as it seems that this being an issue is certainly not isolated.

It wasn't so bad, and would have been easier if I wasn't dealing with a few hundred domains at the same time! I used certbot to automate the process and have a .sh script to update the TXT record for the applicable domain to confirm ownership for the wildcard. This is all done by a CodeBuild plan so I could hook it up to other events to automate, but could be replicated in a simple shell script.

It's possible to have LetsEncrypt provision wildcard certificates, but does require a bit of configuration. I recently moved our SaaS product over to LetsEncrypt to reduce the overhead of renewing the certificates (and of course to remove the cost) and in the end also migrated over our wildcards, which was nice. Ownership of regular domains / subdomains requires proving you own the domain. Typically this can be done by putting a specific file in a specific publicly accessible location, in turn proving you have access to the webserver behind the domain. The other option is to alter the DNS records to add a TXT record again proving ownership. For wildcards, you need to perform the DNS option to prove ownership of the root domain. It's certainly made my life easier when it comes to HTTPS provisioning!

It sounds like they are either moving their email sending to SES, or have misconfigured something. By default SES send through the *.amazonses.com domain unless you have set up a validated Domain that's set up just right. I'm sure that they'll sort it out soon enough though.

Using a VPN is really the simplest option. I recently set up an AWS EC2 instance with OpenVPN installed via https://github.com/angristan/openvpn-install with an Elastic IP to provide a static IP for staff access while working remotely without being tied to the office IP / connection. The limiting factor becomes the member of staffs broadband connection, and the cost is relatively low depending how large an instance you go for. It does require a small client to be installed, however it works and is fast enough. I've even had a decent enough connection to play games when I forget to disconnect it. Also works on any device, be it Windows, OSX, Android, iPhone etc Of course it doesn't need to be an AWS instance - any server will do - but by hosting it on an external/cloud provider you remove the bottleneck you may have if it's hosted on-premise somewhere.

That sounds like an error on the other (Firefly) end Danp - we also run our service on AWS and when I had issues with my httpd layer, I was seeing the same error. Just means that your server isn't able to get a response from the other server.

This sounds like it may be covered in a similar way to AWS services. They published guidance, https://aws.amazon.com/compliance/gdpr-center/brexit/, which indicates that currently their standard contractual clauses are sufficient in any case. The same document also mentions that transferring in/out of the EEA is covered within Standard Contractual Clauses. I would assume that Google has similar clauses which in turn would cover this move. I am not a lawyer though, so it may be there's something I've not been aware of. It does seem odd though, as mentioned having the data further away from the point of use feels inefficient.

At the end of the day it was cheap, simple, but with customisation. Also we found some minor niggles with it and the company was quick to resolve them which was reassuring. Considering that most of the others we checked (off the top of my head these included Bitrix, People HR, can't remember the others) were more expensive, missed the peer review features (which may be less important to you - we were looking to move away from Small Improvements also), etc I have clear overview of my team and can clearly manage their leave, and at the same time my manager can do the same for my peers and I The mobile offering is fully featured also which is nice. The navigation can be a little confusing, but that seems common in a lot of these systems which have so many features in, just takes a little getting used to The most common actions are intuitive enough

Whilst this isn't in a school, we have just looked into the HR systems out there with a view to starting to use one in-house and in the end decided to go with CakeHR due to its ease of use, low cost, and supporting all the features we looked for with regard to absence management, peer reviews, training management, onboarding etc - I'm not sure whether it's at all suitable for your purpose, but it can't hurt to take a look I'm sure https://cake.hr/