Certbot-auto fails to install automatic renewal?

Help
1

I am using kernel 3.10 on CentOS 7. I have successfully installed CertBot 1.10.1 using alternative installation instructions as certbot-auto . Running certbot-auto successfully generated certificates for my nginx (1.7.8) installation. Simulating renewal with the sudo /usr/local/bin/certbot-auto renew --dry-run was also successful.

The problem is that I can not find/confirm that certbot is actually installed for automatic launch. Docs indicate that CentOS EPEL 7 should use systemd. However, running systemctl list-timers --all indicate that there is no timer set up for CertBot. There is nothing in /etc/systemd/system/ related to CertBot. I have checked crontab -l just in case -- nothing.

Why there is no auto-renewal set up?

Is it a mistake in the docs, or am I missing something?

Should I look elsewhere? Should I create the timer/job manually?

certbot 1.10.1

nginx 1.7.8

kernel 3.10.0-123.20.1.el7.x86_64

NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

P.S. I have used alternative installation method, because the default CertBot's installation with snapd does not work -- it complains:

error: system does not fully support snapd: cannot read the value of
         fs.may_detach_mounts kernel parameter: open
         /proc/sys/fs/may_detach_mounts: no such file or directory

which I assume means that my kernel version is too old for snapd to work.

1 Like
2

Did you actually install such a systemd timer? Because that doesn't just happen by itself. The CentOS EPEL 7 docs you're referring to are for certbot installed by the distribution packages, which come with a systemd timer or cronjob in the package. However, you've installed certbot through certbot-auto, which is not the same as installing certbot through a distribution package.

So, to summarize: if you've installed certbot through the (deprecated) certbot-auto wrapper script, you have to install a cronjob or systemd timer for renewal manually.

2 Likes
3

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.