4 ms·
I set it up ages ago, maybe before they even had a script. My setup is dead simple: A crontab that runs monthly: 0 2 1 * * /usr/local/bin/letsencrypt-renew
by ryandrake 11mo ago
I set it up ages ago, maybe before they even had a script. My setup is dead simple: A crontab that runs monthly:
0 2 1 * * /usr/local/bin/letsencrypt-renew
And the script:
#!/bin/sh
certbot renew
service lighttpd restart
service exim4 restart
service dovecot restart
... and so on for all my services
That's it. It should be bulletproof, but every few renewals I find that one of my processes never picked up the new certificates and manually re-running the script fixes it. Shrug-emoji.
- jacquesm 11mo agoYes, same for me. Every few months some kind internet denizen points out to me that my certificate has lapsed, running it manually usually fixes it. LE software is pretty low quality, I've had multiple issues over the years some of which culminated in entire systems being overwritten by LE's broken python environment code.
- account42 11mo agoIf it's happening regularly wouldn't it make sense to add monitoring for it? E.g. my daily SSL renew check sanity-checks the validity of the certificates actually used by the affected services using openssl s_client after each run.
- noAnswer 11mo agoI don't know how old "letsencrypt-renew" is and what it does. But you run "modern" acme clients daily. The actual renewal process starts with 30 days left. So if something doesn't work it retries at least 29 times. I haven't touched my OpenBSD (HTTP-01) acme-client in five years: acme-client -v website && rcctl reload httpd My (DNS-01) LEGO client sometimes has DNS problems. But as I said, it will retry daily and work eventually.
- Dylan16807 11mo ago> I don't know how old "letsencrypt-renew" is and what it does. It's the five lines below "the script:"
- noAnswer 11mo agoI'm sorry mister perfect. I officiously meant "certbot".
- Dylan16807 11mo agoI wasn't making fun of you. It wasn't obvious that's what you meant at all, because you said you didn't know "what it does". I'm sure you know what certbot does, so I thought you misinterpreted the post.