I'm running certbot on Ubuntu 20.04 in AWS, installed as a snap package. I'm not sure if certbot renewal is running properly. I'd appreciate some help working out how to best get it working.
This is a new server, which I turn on and off while I'm getting it ready for production. It runs about 8 - 10 hours a day at the moment. It's not often running at midnight, which I think is when the cron job runs. It will be on 24/7 in a few days once I finish the configuration.
One thing I found is this question answer saying
You shouldn't have to set up anything. Any recent Debian/Ubuntu install of certbot should install a systemd timer and a cron job (and the cron job will only run certbot if systemd is not active, so you don't get both running).
It looks to me like the certbot timer isn't running, and if it did it appears to be pointing at /dev/null. Because systemd is active I wonder if the cron job is running.
Timers and systemd
I found a comment there may be an issue with timers and snap so maybe this is a known issue.
The timer doesn't seem to run
NEXT LEFT LAST PASSED UNIT ACTIVATES Wed 2021-03-17 23:44:00 UTC 3h 24min left n/a n/a snap.certbot.renew.timer snap.certbot.renew.service
Certbot timer appears to point at /dev/null. This question indicates that's not how it should be.
> root@aws2:/etc/systemd/system# ls -l | grep certbot lrwxrwxrwx 1 root root 9 Jan 9 06:38 certbot.timer -> /dev/null
I can see the following in syslog but I'm not sure what it means
Mar 17 16:51:02 aws2 systemd: Started Timer renew for snap application certbot.renew.
In syslog I can see this the cron job is running but there's no output
Mar 16 00:00:01 aws2 CRON: (root) CMD (test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew)
The following is in /etc/cron.d/certbot (this was presumably put there by the certbot installation, I get the general idea of what it does but I don't know what the test / perl stuff does)
SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin 0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew
When I run the whole command (root test /x etc) I get the message below.
Command 'root' not found, but can be installed with: snap install root-framework
When I run this part I get no output (note I have removed the "-q" from certbot for testing). I'm not sure what the test part is doing, but certbot doesn't seem to do anything when I run this command.
> test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot renew
- Any ideas what's up with the systemd timer, why it's pointing at /dev/null? Or should I just ignore this known issue?
- Should I "snap install root-framework" to install "root" like Ubuntu is suggesting?
- The cron job "root test" doesn't appear to be doing anything... any anyone explain what is being tested there and whether "cerbot renew" it's actually running?
Update - Proposed Solution (updated again)
Note that this wasn't necessary. The systemd timer started working fine.
In the /etc/cron.daily folder I've created the following folder. I think it will do what I want, I'll check logs at some point to see. I'm still interested in the questions I asked above.
SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin /usr/bin/certbot -q renew