2

I decided to put monit on my vps running centos 7. I've already got let's encrypt on the server and the certs are installed. I wanted to point monit at the fullchain.pem or the cert.pem, but I get this error.

    Dec 30 00:56:52 [23926]: The SSL server PEM file 
    '/etc/letsencrypt/live/example.com/fullchain.pem' must have permissions no more than -rwx------ (0700); right now permissions are -rw-r--r-- (0644).
    Dec 30 00:56:52 monit[23926]: /etc/monitrc:131: SSL server PEM file permissions check failed 'allow'
    Dec 30 00:56:52  systemd[1]: monit.service: main process exited, code=exited, status=1/FAILURE

Not sure how to proceed. Do I change the owner of the cert files? Do I change the owner who runs monit?

1

Monit is quite strange in that it expects the private key and TLS certificate chain to be concatenated into a single file specified by pemfile, so you can't use certificates retrieved with certbot without some further processing.

You will need to set up a deploy hook in certbot in order to concatenate the certificates into a single file and set permissions on that file.

An example script might look like:

#!/bin/bash

for domain in $RENEWED_DOMAINS
do
    case $domain in
    example.com)
        cat $RENEWED_LINEAGE/privkey.pem $RENEWED_LINEAGE/fullchain.pem > /etc/monit/pemfile-$domain.pem
        chmod 600 /etc/monit/pemfile-$domain.pem
        ;;
done

Then renew with certbot renew --deploy-hook '/path/to/that/script.sh'.

And in monit specify pemfile /etc/monit/pemfile-example.com.pem

Finally, you can restart monit with the renewed cert with something like a certbot renew --post-hook 'systemctl restart monit'...

| improve this answer | |
1

As of Monit v5.27.0, released 2020-06-29, you can now pass in pemchain and pemkey parameters pointing to the separate files that Let's Encrypt generates. Quoting from the documentation:

As an alternative PEMCHAIN and PEMKEY sets the path to separate PEM encoded certificate chain and private key file. The key file should be stored in a safe place on the filesystem and should have strict permissions, no more than 0700.

...

Example for using separate certificate chain and key:

set httpd
    port 2812
    with ssl {
       pemchain: /etc/ssl/certs/monit.chain.pem
       pemkey: /etc/ssl/certs/monit.key.pem
    }
    allow myuser:mypassword

See also: PR #78.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.