The whole day, I am fixing bugs in mainly TLS area, but this question is not specifically about TLS.
Well, I have one web server with a few web sites, each with its own SSL certificate.
But to the point, I managed to install Certbot version 0.19.0 on my Debian 9.2 like this:
Adding backports to the sources:
deb http://ftp.debian.org/debian stretch-backports main
Installing newer version of Certbot from backports:
apt-get install python-certbot-apache -t stretch-backports
Afterwards, I had to make some major adjustments to the renewal file, so it looks like this:
# renew_before_expiry = 30 days version = 0.10.2 archive_dir = /etc/letsencrypt/archive/pavelstriz.cz-0001 cert = /etc/letsencrypt/live/pavelstriz.cz-0001/cert.pem privkey = /etc/letsencrypt/live/pavelstriz.cz-0001/privkey.pem chain = /etc/letsencrypt/live/pavelstriz.cz-0001/chain.pem fullchain = /etc/letsencrypt/live/pavelstriz.cz-0001/fullchain.pem # Options used in the renewal process [renewalparams] authenticator = webroot installer = apache rsa_key_size = 4096 account = c3f3d026995c1d7370e4d8201c3c11a2 must_staple = True [[webroot_map]] pavelstriz.cz = /home/pavelstriz/public_html www.pavelstriz.cz = /home/pavelstriz/public_html
I have managed to renew the
pavelstriz.cz domain after this with:
certbot renew --dry-run
But what worries me is the daily Certbot's cron:
# /etc/cron.d/certbot: crontab entries for the certbot package # # Upstream recommends attempting renewal twice a day # # Eventually, this will be an opportunity to validate certificates # haven't been revoked, etc. Renewal will only occur if expiration # is within 30 days. SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin 0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew
I can't figure out if it works for real or how to run it successfully?
If I run:
/usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew
in Bash, it says:
Saving debug log to /var/log/letsencrypt/letsencrypt.log The requested ! plugin does not appear to be installed
I may have misunderstood those commands.