Thanks for the question. Letsencrypt supports post deploy hooks. I used it with the following.
I am using a Debian 10 buster with coturn 22.214.171.124-1.1 and letsencrypt certbot 0.31.0 .
- coturn user:
- coturn group:
- letsencrypt configuration folder:
- domain name:
- coturn service can be restarted with this command:
service coturn restart
- coturn configuration file:
Please adapt accordingly if your configuration differs from the above assumptions.
mkdir -p /etc/coturn/certs
chown -R turnserver:turnserver /etc/coturn/
chmod -R 700 /etc/coturn/
chmod 700 /etc/letsencrypt/renewal-hooks/deploy/coturn-certbot-deploy.sh
Adapted coturn-certbot-deploy.sh for coturn from the linked letsencrypt page example:
for domain in $RENEWED_DOMAINS; do
case $domain in
# Make sure the certificate and private key files are
# never world readable, even just for an instant while
# we're copying them into daemon_cert_root.
cp "$RENEWED_LINEAGE/fullchain.pem" "$daemon_cert_root/$domain.cert"
cp "$RENEWED_LINEAGE/privkey.pem" "$daemon_cert_root/$domain.key"
# Apply the proper file ownership and permissions for
# the daemon to read its certificate and key.
chown turnserver "$daemon_cert_root/$domain.cert" \
chmod 400 "$daemon_cert_root/$domain.cert" \
service coturn restart >/dev/null
You need to change
example.com to your domain name in the above file.
Edit the certificate files locations in the coturn configuration file:
With those lines for
I was able to test the renewal through this command for all the certificates:
certbot renew --force-renewal
Or this command only for a given domain:
certbot certonly --force-renewal -d example.com
My coturn logs no longer show the following lines:
0: WARNING: cannot find certificate file: /etc/letsencrypt/live/example.com/fullchain.pem (1)
0: WARNING: cannot start TLS and DTLS listeners because certificate file is not set properly
0: WARNING: cannot find private key file: /etc/letsencrypt/live/example.com/privkey.pem (1)
0: WARNING: cannot start TLS and DTLS listeners because private key file is not set properly
Instead, I get the nice following ones:
0: ...: Certificate file found: /etc/coturn/certs/example.com.cert
0: ...: Private key file found: /etc/coturn/certs/example.com.key