How to validate / fix an error in Certbot renewal cron

Question

The whole day, I am fixing bugs in mainly TLS area, but this question is not specifically about TLS.

Well, I have one web server with a few web sites, each with its own SSL certificate.

But to the point, I managed to install Certbot version 0.19.0 on my Debian 9.2 like this:

1. Adding backports to the sources:

   deb http://ftp.debian.org/debian stretch-backports main
   

2. Installing newer version of Certbot from backports:

   apt-get install python-certbot-apache -t stretch-backports
   

Afterwards, I had to make some major adjustments to the renewal file, so it looks like this:

# renew_before_expiry = 30 days
version = 0.10.2
archive_dir = /etc/letsencrypt/archive/pavelstriz.cz-0001
cert = /etc/letsencrypt/live/pavelstriz.cz-0001/cert.pem
privkey = /etc/letsencrypt/live/pavelstriz.cz-0001/privkey.pem
chain = /etc/letsencrypt/live/pavelstriz.cz-0001/chain.pem
fullchain = /etc/letsencrypt/live/pavelstriz.cz-0001/fullchain.pem

# Options used in the renewal process
[renewalparams]
authenticator = webroot
installer = apache
rsa_key_size = 4096
account = c3f3d026995c1d7370e4d8201c3c11a2
must_staple = True

[[webroot_map]]
pavelstriz.cz = /home/pavelstriz/public_html
www.pavelstriz.cz = /home/pavelstriz/public_html

I have managed to renew the pavelstriz.cz domain after this with:

certbot renew --dry-run

---

But what worries me is the daily Certbot's cron:

# /etc/cron.d/certbot: crontab entries for the certbot package
#
# Upstream recommends attempting renewal twice a day
#
# Eventually, this will be an opportunity to validate certificates
# haven't been revoked, etc.  Renewal will only occur if expiration
# is within 30 days.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew

---

I can't figure out if it works for real or how to run it successfully?

If I run:

/usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew

in Bash, it says:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
The requested ! plugin does not appear to be installed

I may have misunderstood those commands.

Answer 1

The actual command run by cron is:

test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew

It starts by testing some files

test -x /usr/bin/certbot -a \! -d /run/systemd/system

which translates in

• does /usr/bin/certbot exist and is executable (-x /usr/bin/certbot)
• and not (-a \!)
• /run/systemd/system exist and is a directory (-d /run/systemd/system)

If the test succeeds, wait for a random number of seconds (perl -e 'sleep int(rand(3600))'), then try to renew the certificate (certbot -q renew).

However, on Debian 9, systemd is installed by default, which means that /run/systemd/system exists and is a directory, so the initial test fails and the renew command is never run.

The actual renewal is managed by a systemd timer defined in the file lib/systemd/system/certbot.timer. As of version 0.27.0-1; its content is:

[Unit]
Description=Run certbot twice daily

[Timer]
OnCalendar=*-*-* 00,12:00:00
RandomizedDelaySec=43200
Persistent=true

[Install]
WantedBy=timers.target

If cerbot is properly configured, you should probably find lines like

Nov  2 20:06:14 hostname systemd[1]: Starting Run certbot twice daily.
Nov  2 20:06:14 hostname systemd[1]: Started Run certbot twice daily.

in your syslog.

Answer 2

I may have misunderstood those commands.

Umm, maybe, a little :-)

This entry:

0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew

I cannot make heads or tails of. All you need is, in fact, something like:

0 */12 * * * /usr/bin/certbot renew

Or, if you don't want any e-mails from cron:

0 */12 * * * /usr/bin/certbot renew > /dev/null 2>&1

If you run (as root) certbot renew you will see if you have configured things properly or not:

certbot renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/my.domain.org.conf
-------------------------------------------------------------------------------
Cert not yet due for renewal

The following certs are not due for renewal yet:
  /etc/letsencrypt/live/my.domain.org/fullchain.pem (skipped)
No renewals were attempted.

You can also use the certificates argument with certbot to display information about your certificates:

certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
Found the following certs:
  Certificate Name: my.domain.org
    Domains: my.domain.org
    Expiry Date: 2018-03-14 09:41:09+00:00 (VALID: 53 days)
    Certificate Path: /etc/letsencrypt/live/my.domain.org/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/my.domain.org/privkey.pem
-------------------------------------------------------------------------------