1

System: GNU/Linux Debian 9.5 headless.

Situation & Question

I have just caught the Let's Encrypt Certbot to re-generate the SSL certificate but did not reload Apache2. This has resulted in a half-day not functioning domain. I want to automate this. How to go about it?

This is my current Certbot CRON file /etc/cron.d/certbot:

# /etc/cron.d/certbot: crontab entries for the certbot package
#
# Upstream recommends attempting renewal twice a day
#
# Eventually, this will be an opportunity to validate certificates
# haven't been revoked, etc.  Renewal will only occur if expiration
# is within 30 days.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew
  • Is it really needed to load perl to just sleep? Why not a simpler sleep $RANDOM, yes not exactly 12 hours, but "what does it really matter?". An sleep of max 32767 should be quite enough. In fact, why not sleep "$((100+RANDOM))" to ensure a minimum value. Or, since I am asking, why not just sleep 20?. – Isaac Oct 28 '18 at 2:28
  • @Isaac Ask Let's Encrypt team for this. I did not write this myself. – LinuxSecurityFreak Oct 28 '18 at 4:51
1

I usually tend to avoid restarting services just for the sake of restarting them, for several reasons. So I would advise just restarting Apache when the certificate has been renewed.

For certbot, it seems you can restart apache2 when the cert is renewed putting in a crontab:

certbot renew --renew-hook "apachectl -k graceful"

You can also find the date when you have a new certificate, and then only restart your Apache.

Just for an introduction to the theme, this is how you can check a X.509 certificate starting validity date:

$ openssl x509 -startdate -noout -in ZscalerChain.crt 
notBefore=Jan  6 22:36:34 2015 GMT

or for epoch time:

$ date --date $(openssl x509 -startdate -noout -in ZscalerChain.crt | awk -F"=" ' { print $2 } ') +%s
1420583794

Or you can cheat, and check file dates. So something similar to this:

FILE=~/tmp/savedate
CERT=~/yourcert.crt

if [ ! -f $FILE ]
then
    touch --date="last year" $FILE
fi
DATE1=$(date -r $FILE +%s)
DATE2=$(date -r $CERT +%s)

if [ $DATE2 > $DATE1 ]
then
    touch $FILE
    sudo apachectl -k graceful
fi

Or verifying the X.509 certificate starting date:

FILE=~/tmp/savedate
CERT=~/yourcert.crt

if [ ! -f $FILE ]
then
    touch --date="last year" $FILE
fi
DATE1=$(date -r $FILE +%s)
DATE2=$(date --date $(openssl x509 -startdate -noout -in $CERT | awk -F"=" ' { print $2 } ') +%s)

if [ $DATE2 > $DATE1 ]
then 
    touch $FILE
    sudo apachectl -k graceful
fi

There are other ways of doing this. For instance, if it is of utmost importance to restart Apache as soon as the certificate is renewed, you might monitor the file change with inotify instead and act accordingly.

2

This can be simply accomplished by adding:

&& apachectl -k graceful

to the daily Certbot command.

This way, twice a day:

  • The certificates will get checked for expiration and if expired, then they'll get renewed.

  • Apache will get reloaded. Apache will advise its threads to exit when idle, and then apache reloads the configuration.

1

I have just found yet another way of doing this, and IMHO this one is the most convenient.

  1. Go to the Let's Encrypt renewal configuration directory:

    # cd /etc/letsencrypt/renewal
    
  2. Edit the desired domain config file with the text editor of choice.

  3. Ensure that in this section:

    [renewalparams]
    

    there are hooks for the Apache stop / start:

    pre_hook = service apache2 stop
    post_hook = service apache2 start
    

    This should ensure, that Apache2 is stopped before the renewal process starts, and also starting it afterwards.

  • This is promising, but I am not sure I would prefer to stop and restart it, and not before. Would it not be better doing it only on the post hook – Rui F Ribeiro Oct 28 '18 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.