3

I've developed a REST API in Node and installed nginx as reverse proxy in front of that in order to handle the SSL certificate from Letsencrypt. It's the first time I've set up nginx but everything seems to work as intended. The certbot installation was uneventful and the certificate is in place and works. My only concern is that I can't see any evidence of auto-renewal in place.

The Certbot docs say:

The command to renew certbot is installed in one of the following locations:

/etc/crontab/
/etc/cron.*/*
systemctl list-timers

I've checked all the above locations but there are no traces of certbot anywhere. Running sudo certbot renew --dry-run works without any error messages but no cron job or timer is created as far as I can see. Are the docs outdated or is the problem my lacking Linux skills?

The server is running Ubuntu 20.04.1 LTS and nginx/1.18.0 (Ubuntu).

3 Answers 3

2

By default on Ubuntu 18.04+, certbot should add /etc/cron.d/certbot and run every 12 hours (*/12). If you do not see a file there, you can create your own cronjob by doing sudo crontab -e and adding a simple job that follows the template instructions. You'll need to be sure that cron understands where certbot lives, or use the full path. Generally the full path is a better bet than hoping cron knows your PATH. By default certbot should be at /usr/local/bin/certbot

You can verify where certbot lives by doing which certbot

The command you should enter in your cron job will be /path/to/certbot renew

To run a midnightly renewal every Day of the Month, Every Month, on every Day of the Week, if everything is default and you're using Ubuntu, the full line you'd add in cron would be:

# m h DoM Mon DoW        command:
  0 0 *   *   *          /usr/local/bin certbot renew
1
  • Thanks! I still don't know why the timer wasn't added, but your guide was helpful in adding it manually. Oct 9, 2020 at 9:18
5

Looks like more recent configurations put the renewal into systemd vs. cron. See here Certbot User Guide

1
  • 2
    That was it. To see it I had to do systemctl list-timers. Was about to add a cronjob. Thanks for pointing this out!
    – Chris
    Aug 8, 2021 at 8:48
1

Quoting https://certbot.eff.org/docs/using.html?highlight=renew#automated-renewals

Automated Renewals Most Certbot installations come with automatic renewals preconfigured. This is done by means of a scheduled task which runs certbot renew periodically.

If you are unsure whether you need to configure automated renewal:

Review the instructions for your system and installation method at https://certbot.eff.org/instructions. They will describe how to set up a scheduled task, if necessary. If no step is listed, your system comes with automated renewal pre-installed, and you should not need to take any additional actions.

On Linux and BSD, you can check to see if your installation method has pre-installed a timer for you. To do so, look for the certbot renew command in either your system’s crontab (typically /etc/crontab or /etc/cron./) or systemd timers (systemctl list-timers).

If you’re still not sure, you can configure automated renewal manually by following the steps in the next section. Certbot has been carefully engineered to handle the case where both manual automated renewal and pre-installed automated renewal are set up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.