1

I am currently facing a problem with my Mac OS-X El Capitan machine when running certbot (or basically letsencrypt).

My machine is a mac mini, that is supposedly running an MDM solution with letsencrypt as its SSL certificate. My MDM is working fine, and i just want to automate the renewal of SSL certificate via certbot.

I followed this guide for the entire set-up - Joshua Jung, Medium.com - setting up mac mini OSX as MDM

This is my script file - get-cert.sh

#!/bin/sh
DOMAIN="mdm.school.domain"
PEM_FOLDER="/etc/letsencrypt/live/${DOMAIN}/"
# Renew the certificate
# sudo certbot renew --quiet # old way, didn't work.
# new way below - 
# sudo certbot renew —-cert-name ${DOMAIN} -q
# Generate a passphrase
echo starting password
PASS=$(openssl rand -base64 45 | tr -d /=+ | cut -c -30)
echo finish password - looks like no problem.
# Transform the pem files into a p12 file
echo start openssl
sudo openssl pkcs12 -export -inkey "${PEM_FOLDER}privkey.pem" -in "${PEM_FOLDER}cert.pem" -certfile "${PEM_FOLDER}fullchain.pem" -out "${PEM_FOLDER}letsencrypt_sslcert.p12" -passout pass:$PASS
echo end openssl
# Import the p12 file into the keychain
echo start security import
sudo security import "${PEM_FOLDER}letsencrypt_sslcert.p12" -f pkcs12 -k /Library/Keychains/System.keychain -P $PASS -T /Applications/Server.app/Contents/ServerRoot/System/Library/CoreServices/ServerManagerDaemon.bundle/Contents/MacOS/servermgrd
echo end security import

I have 2x issues actually.

First, while i can renew the certificate manually, meaning, if i enter "sudo certbot renew", the certificate gets renewed successfully. However, if I were to run the command through the script, the error occurs stating that there's an argument error.

-q/--quiet: ignored explicit argument '\r'.

second, i encounter error with the openssl import, whereby the error shows:

cert.pemening input file /etc/letsencrypt/live/mdm.school.domain cert.pem: No such file or directoryg

i do have a 3rd issue, where the error occur as per below -

letsencrypt_sslcert.p12: no such file or directoryve/mdm.school.domain but i think this error is related to the second one.

I am stumped at the moment. I have the directories all set properly. I have given 0755 or 0777 permission to the required files in the "live" folder to all the files (.pem and .p12).

when I run = sudo certbot certificates, i got the info that expiry date is set to 89 days later. certificate path and private key path are correct to the location that is stored at - /etc/letsencrypt/live/mdm.school.domain/fullchain.pem and privkey.pem

Having said that, the content of the live folder, as i checked using finder, is essentially a symlink to the archive folder.

I have also ensured that the archive folder access is given 0755 for privileges.

closed as off-topic by Jeff Schaller, Stephen Rauch, G-Man, Sparhawk, jimmij Nov 19 '17 at 14:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – Jeff Schaller, Stephen Rauch, G-Man, Sparhawk, jimmij
If this question can be reworded to fit the rules in the help center, please edit the question.

  • my certbot is v 0.15 – joke Sep 12 '17 at 5:08
2

I have resolved this issue. the problem relates to the carriage return to the get-help.sh script file at the end of the lines.

The best approach to determine if my file have issues in MAC OS-X is to use vim editor and remove the ^M at the end of the lines where carriage returns are found.

Not the answer you're looking for? Browse other questions tagged or ask your own question.