letsencrypt has stopped auto renewing

Question

I set up my letsencrypt certs at the beginning of this year and all was working fine - they've all auto renewed with a crontab job at least once in that time. I originally used this walkthrough to set them up: https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-14-04

However I received a notification of expiry yesterday, and this morning a cert officially expired.

I've check my crontab jobs and they look fine, and the log only shows successes, so the issue doesn't seem to be there.

So I tried running the auto renew process manually using:

/opt/letsencrypt/letsencrypt-auto renew

No errors, and I receive the congratulations message informing that all renewals succeeded.

Congratulations, all renewals succeeded. The following certs have been renewed: …

However, none of the certs have actually been updated. The site for which I received the notification yesterday still has the same expiry date (early this morning), so it doesn't seem to have actually updated.

Has something changed in the last 6 months that could cause this issue? I really need to get these certs renewed…

Edit: Ok so I missed this error originally (as it flagged way up the process so was easily missed):

certbot.cli:You are running with an old copy of letsencrypt-auto that does not receive updates, and is less reliable than more recent versions. We recommend upgrading to the latest certbot-auto script, or using native OS packages.

(although it would have been more helpful to stress that it's not just outdated, it doesn't work)

This thread (https://community.letsencrypt.org/t/message-about-out-of-date-software/16425) indicates that the autorenew process needs to be replaced with Certbot (https://certbot.eff.org/#ubuntutrusty-nginx). I've managed to drop this on my server and generate new certs (the instructions were a bit high-level for me, but I just about managed - although rather than save the certs in the same directories it created new ones with '0001' appended, meaning I also had to update all my nginx config… sigh) - however I have no idea how to work this into the auto renewal process I had set up with letsencrypt and crontab. If anyone can point at any documentation on how to officially switch between methods that'd be great - for now I've set a reminder to run the process again in 5 months…

Answer 1

I can see an improvement to your process.

To avoid this problem of certificate replacement, I use the certonly option. This causes certbot to maintain the certificates in a directory (for me it is /etc/letsencrypt).

I tell the http daemon to look for the certificates in /etc/letsencrypt/live/${site}/fullchain.pem and the keys in /etc/letsencrypt/live/${site}/privkey.pem, which are symlinks the renewer keeps up to date. All that is needed to complete the renewal is to restart the daemon.