3

The whole day, I am fixing bugs in mainly TLS area, but this question is not specifically about TLS.

Well, I have one web server with a few web sites, each with its own SSL certificate.

But to the point, I managed to install Certbot version 0.19.0 on my Debian 9.2 like this:

  1. Adding backports to the sources:

    deb http://ftp.debian.org/debian stretch-backports main
    
  2. Installing newer version of Certbot from backports:

    apt-get install python-certbot-apache -t stretch-backports
    

Afterwards, I had to make some major adjustments to the renewal file, so it looks like this:

# renew_before_expiry = 30 days
version = 0.10.2
archive_dir = /etc/letsencrypt/archive/pavelstriz.cz-0001
cert = /etc/letsencrypt/live/pavelstriz.cz-0001/cert.pem
privkey = /etc/letsencrypt/live/pavelstriz.cz-0001/privkey.pem
chain = /etc/letsencrypt/live/pavelstriz.cz-0001/chain.pem
fullchain = /etc/letsencrypt/live/pavelstriz.cz-0001/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = webroot
installer = apache
rsa_key_size = 4096
account = c3f3d026995c1d7370e4d8201c3c11a2
must_staple = True

[[webroot_map]]
pavelstriz.cz = /home/pavelstriz/public_html
www.pavelstriz.cz = /home/pavelstriz/public_html

I have managed to renew the pavelstriz.cz domain after this with:

certbot renew --dry-run

But what worries me is the daily Certbot's cron:

# /etc/cron.d/certbot: crontab entries for the certbot package
#
# Upstream recommends attempting renewal twice a day
#
# Eventually, this will be an opportunity to validate certificates
# haven't been revoked, etc.  Renewal will only occur if expiration
# is within 30 days.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew

I can't figure out if it works for real or how to run it successfully?

If I run:

/usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew

in Bash, it says:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
The requested ! plugin does not appear to be installed

I may have misunderstood those commands.

1

The actual command run by cron is:

test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew

It starts by testing some files

test -x /usr/bin/certbot -a \! -d /run/systemd/system

which translates in

  • does /usr/bin/certbot exist and is executable (-x /usr/bin/certbot)
  • and not (-a \!)
  • /run/systemd/system exist and is a directory (-d /run/systemd/system)

If the test succeeds, wait for a random number of seconds (perl -e 'sleep int(rand(3600))'), then try to renew the certificate (certbot -q renew).

However, on Debian 9, systemd is installed by default, which means that /run/systemd/system exists and is a directory, so the initial test fails and the renew command is never run.

The actual renewal is managed by a systemd timer defined in the file lib/systemd/system/certbot.timer. As of version 0.27.0-1; its content is:

[Unit]
Description=Run certbot twice daily

[Timer]
OnCalendar=*-*-* 00,12:00:00
RandomizedDelaySec=43200
Persistent=true

[Install]
WantedBy=timers.target

If cerbot is properly configured, you should probably find lines like

Nov  2 20:06:14 hostname systemd[1]: Starting Run certbot twice daily.
Nov  2 20:06:14 hostname systemd[1]: Started Run certbot twice daily.

in your syslog.

1

I may have misunderstood those commands.

Umm, maybe, a little :-)

This entry:

0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew

I cannot make heads or tails of. All you need is, in fact, something like:

0 */12 * * * /usr/bin/certbot renew

Or, if you don't want any e-mails from cron:

0 */12 * * * /usr/bin/certbot renew > /dev/null 2>&1

If you run (as root) certbot renew you will see if you have configured things properly or not:

certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/my.domain.org.conf
-------------------------------------------------------------------------------
Cert not yet due for renewal

The following certs are not due for renewal yet:
  /etc/letsencrypt/live/my.domain.org/fullchain.pem (skipped)
No renewals were attempted.

You can also use the certificates argument with certbot to display information about your certificates:

certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
Found the following certs:
  Certificate Name: my.domain.org
    Domains: my.domain.org
    Expiry Date: 2018-03-14 09:41:09+00:00 (VALID: 53 days)
    Certificate Path: /etc/letsencrypt/live/my.domain.org/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/my.domain.org/privkey.pem
-------------------------------------------------------------------------------

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.