0

Hi i have a machine based on Debian Jessie running an apache web server along with certbot 0.10.2.

Due to this message i've received:

As of June 1, 2021, you are no longer be able to renew your certificates using ACMEv1. You should upgrade to an ACMEv2 compatible client, or certificate issuance will fail.

I would like to upgrade to an ACMEv2 compatible version of certbot.

what i have done so far is:

echo 'deb http://archive.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/backport.list

echo 'Acquire::Check-Valid-Until no;' > /etc/apt/apt.conf.d/no-check

apt update

Now, for what i know, i should be able to run:

apt-get install python-certbot-apache -t jessie-backports

and install the latest backported release, but since i already have certbot installed and also i have certificates issued, i would like to upgrade instead of install.

It is possible to do some kind of -only-upgrade on a single package using backports, or at least unistall the old version of certbot without deleting issued certificates?

PS: i have seen somehting like sudo apt -t jessie-backports upgrade to update the entire system, but i don't know if it's possible to use on single package

Thank you very mutch in advance.

4 Answers 4

1

Thank you to everyone for the support.

I finally solved the problem, using a different ACME client as suggested here

Even though the procedure to install a certificate is quite easy, i want to share my steps:

First install the client:

wget -O -  https://get.acme.sh | sh -s [email protected]

After the installation, you must close the current terminal and reopen it to make the alias take effect.

NB: the installation also create daily cron job to check and renew the certs if needed, so, if you have other certbot task scheduled into the crontab, remove it. if you don't have any cronjobs, means the renew task is automated, so, you have two options:

  • issue certbot delete to delete the old certificate interactively
  • just rename the /etc/letsencrypt/renewal/example.com.conf file, If you don't want to delete it.

Anyway do this only at the end of the process, when everything is working right.

since i'm on apache server and i needed 2 domains (naked and full) i have used the apache module like this:

acme.sh --issue --apache -d example.com -d www.example.com

if everything goes right, this should have created the certificates (check the console for the current path).

now it's time to install the certificates so i created a folder to store it:

mkdir -p /etc/apache2/certificates/example.com

then i have added the belows lines in the example.com-le-ssl.conf (make a backup first ;-)) to reflect the imminent changes, and removed the old lines created by letsencrypt:

SSLEngine on

SSLCertificateFile /etc/apache2/certificates/example.com/cert.pem
SSLCertificateChainFile  /etc/apache2/certificates/example.com/fullchain.pem
SSLCertificateKeyFile /etc/apache2/certificates/example.com/privkey.pem

SSLProtocol             all -SSLv2 -SSLv3
SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
SSLHonorCipherOrder     on
SSLCompression          off

SSLOptions +StrictRequire

finally i have issued the command to install the certificates and reload the apache server

acme.sh --install-cert -d example.com \
--cert-file /etc/apache2/certificates/example.com/cert.pem \
--key-file /etc/apache2/certificates/example.com/privkey.pem \
--fullchain-file /etc/apache2/certificates/example.com/fullchain.pem \
--reloadcmd "service apache2 force-reload"
0

The package python-certbot-apache isn't available for jessie-backports, you need to upgrade your Debian release to Stretch or Buster.

Package search.

2
0

You try to get certbot-auto working: https://github.com/certbot/certbot/blob/master/certbot-auto

It is no longer supported aswell, and it will require some fiddling with the python dependencies too on Jessie, and commenting out some checks in the script itself, but I am successfully using this on a Jessie system that sadly can't be upgraded yet:

wget https://raw.githubusercontent.com/certbot/certbot/1.11.x/certbot-auto
chmod +x certbot-auto

in 894 add:
DEPRECATED_OS=0

in 1753 change:
Bootstrap To BootstrapDebCommon

Run: NO_SELF_UPGRADE=1 ./certbot-auto

Invoke certbot-auto via its full path instead of certbot and the envvar, also in your renew cron.

Beware that this is very hacky and may obviously break again if dependencies, packages, or API things change. This also does NOT receive (security) updates (nor does Jessie itself).

3
  • please, would you like to explane the entire process to make it work?
    – Mr.Tester
    Jun 14, 2021 at 8:02
  • I edited my answer with a working procedure in a clean Jessie env quickly started in Docker
    – Tobias K.
    Jun 14, 2021 at 8:39
  • this one is not supported anymore...
    – Mr.Tester
    Aug 21, 2021 at 18:19
0
apt-get install python-certbot-apache -t jessie-backports

will upgrade python-certbot-apache if it’s already installed in an older version; the use of the verb install doesn’t mean that the package will be installed from scratch.

See Does sudo apt install command also update an already installed app?

1
  • thested it but after all gives me error...
    – Mr.Tester
    Aug 21, 2021 at 18:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .