0

I set up my letsencrypt certs at the beginning of this year and all was working fine - they've all auto renewed with a crontab job at least once in that time. I originally used this walkthrough to set them up: https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-14-04

However I received a notification of expiry yesterday, and this morning a cert officially expired.

I've check my crontab jobs and they look fine, and the log only shows successes, so the issue doesn't seem to be there.

So I tried running the auto renew process manually using:

/opt/letsencrypt/letsencrypt-auto renew

No errors, and I receive the congratulations message informing that all renewals succeeded.

Congratulations, all renewals succeeded. The following certs have been renewed: …

However, none of the certs have actually been updated. The site for which I received the notification yesterday still has the same expiry date (early this morning), so it doesn't seem to have actually updated.

Has something changed in the last 6 months that could cause this issue? I really need to get these certs renewed…

Edit: Ok so I missed this error originally (as it flagged way up the process so was easily missed):

certbot.cli:You are running with an old copy of letsencrypt-auto that does not receive updates, and is less reliable than more recent versions. We recommend upgrading to the latest certbot-auto script, or using native OS packages.

(although it would have been more helpful to stress that it's not just outdated, it doesn't work)

This thread (https://community.letsencrypt.org/t/message-about-out-of-date-software/16425) indicates that the autorenew process needs to be replaced with Certbot (https://certbot.eff.org/#ubuntutrusty-nginx). I've managed to drop this on my server and generate new certs (the instructions were a bit high-level for me, but I just about managed - although rather than save the certs in the same directories it created new ones with '0001' appended, meaning I also had to update all my nginx config… sigh) - however I have no idea how to work this into the auto renewal process I had set up with letsencrypt and crontab. If anyone can point at any documentation on how to officially switch between methods that'd be great - for now I've set a reminder to run the process again in 5 months…

Improve this question
3

I can see an improvement to your process.

To avoid this problem of certificate replacement, I use the certonly option. This causes certbot to maintain the certificates in a directory (for me it is /etc/letsencrypt).

I tell the http daemon to look for the certificates in /etc/letsencrypt/live/${site}/fullchain.pem and the keys in /etc/letsencrypt/live/${site}/privkey.pem, which are symlinks the renewer keeps up to date. All that is needed to complete the renewal is to restart the daemon.

Improve this answer
2
  • 1
    Reloading the web server (e.g. SIGHUP) is sufficient, at least for Apache and nginx. – Michael Hampton Jul 3 '16 at 16:29
  • Actually that's how the original set up worked, as per the DO tutorial I linked; storing the keys via a symlink. The issue was really with the auto-renewal process. "All that is needed to complete the renewal is to restart the daemon." Sounds like it might be the solution I was looking for, but isn't really a complete answer. How would I set up the auto-renewal to replace the existing setup? What daemon am I restarting, how do I do that? Is there a guide somewhere you can link to? – Nathan Hornby Aug 22 '16 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.