1

I'm setting up a systemd service to renew my SSL certificates from letsencrypt. What I'd like to get working is for a systemd timer to stop the nginx service, run my certificate renewal script and then restart nginx.

Does systemd have some clever way of doing this? Or do I just need to do the relevant stop and start action in the script itself?

  • 1
    Why do you need to stop the service ? – user9517 Aug 24 '16 at 12:04
  • Because I'm using the letsencrypt standalone client, which needs to be able to listen on port 443 - which nginx holds open. For various reasons, using the webroot client doesn't work for me. – Tom Aug 24 '16 at 12:05
  • 1
    If you really don't care about the downtime that your plan will cause, then you can certainly do that. But really, it's very easy to make standalone webroot work with nginx. You do not have to stop nginx at all. – Michael Hampton Aug 25 '16 at 4:48
  • You can renew the SSL certificates using Certbot and nginx without any downtime. You don't need the standalone client to listen on 443 for this. Then you can just reload nginx to pick up the new cert. – user292698 Jan 8 '17 at 16:18
2

Does systemd have some clever way of doing this? Or do I just need to do the relevant stop and start action in the script itself?

No, there is no "clever way". Simply put

systemctl stop <whatever>

and

systemctl start <whatever>

in your renew script as necessary,

| improve this answer | |
3

Letsencrypt has a pre and post renewal hooks.

Adding this

[renewal-params]
# Other settings
pre-hook=systemctl stop <service name>
post-hook=systemctl start <service name>

to /etc/letsencrypt/renewal/<domain name>.conf will stop and start the service everytime you run certbot renew.

| improve this answer | |
-1

If I understood correctly, you want to schedule nginx stop to reduce downtime.

I don't know about system D, but with any unix command you can use "at" to build your own command.

For example


echo "systemctll stop nginx && mv /etc/my/cert/new.cert && systemctll start nginx" | at -m 5:00

| improve this answer | |
  • Since the question was specifically whether systemd has some way of handling this, this is not really an answer. – Tom Aug 24 '16 at 12:04
  • The edit doesn't really help - if I'm trying to use systemd timers, how is at involved? – Tom Aug 24 '16 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.