# Certbot auto renewal

**URL:** https://community.letsencrypt.org/t/certbot-auto-renewal/84545
**Category:** Help
**Created:** [January 29, 2019, 10:10am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545 "2019-01-29T10:10:24Z")
**Posts on this page:** 16
**Page:** 1

<div class="post-metadata">

### Author: ![asbern](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@asbern](https://community.letsencrypt.org/u/asbern)
#### Post date: [January 29, 2019, 10:10am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/1 "2019-01-29T10:10:25Z")

</div>

Hi all,

I am facing issue with certbot auto renewal, its failing when it automatically tries to renew, but manually i could renew using " certbot renew" and dry run “certbot renew --dry-run” also working fine,

nginx version 1.14.2

FYI, Below is the error when it tries to auto renew

Subject: XXX\> python -c ‘import random; import time; time.sleep(random.random() \* 3600)’ && certbot renew  
Content-Type: text/plain; charset=UTF-8  
Auto-Submitted: auto-generated  
Precedence: bulk  
X-Cron-Env: \<XDG\_SESSION\_ID=404\>  
X-Cron-Env: \<XDG\_RUNTIME\_DIR=/run/user/0\>  
X-Cron-Env: \<LANG=en\_US.UTF-8\>  
X-Cron-Env: \<SHELL=/bin/sh\>  
X-Cron-Env: \<HOME=/root\>  
X-Cron-Env: \<PATH=/usr/bin:/bin\>  
X-Cron-Env: \<LOGNAME=root\>  
X-Cron-Env: \<USER=root\>  
Message-Id:   
Date: Fri, 18 Jan 2019 00:18:50 +0800 (+08)

Saving debug log to /var/log/letsencrypt/letsencrypt.log

* * *

Processing /etc/letsencrypt/renewal/XXXX.conf

* * *

Cert is due for renewal, auto-renewing…  
Could not choose appropriate plugin: The nginx plugin is not working; there may be problems with your existing configuration.  
The error was: NoInstallationError()  
Attempting to renew cert [XXX.Y.com](http://XXX.Y.com)) from /etc/letsencrypt/renewal/XXX.Y.com.conf produced an unexpected error: The nginx plugin is not working; there may be problems with your existing configuration.  
The error was: NoInstallationError(). Skipping.  
All renewal attempts failed. The following certs could not be renewed:  
/etc/letsencrypt/live/XXX.Y.com/fullchain.pem (failure)

* * *

All renewal attempts failed. The following certs could not be renewed:  
/etc/letsencrypt/live/XXX.Y.com/fullchain.pem (failure)

* * *

1 renew failure(s), 0 parse failure(s)

---

<div class="post-metadata">

### Author: ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [January 29, 2019, 5:29pm UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/2 "2019-01-29T17:29:54Z")

</div>

> [@asbern](#):
>
> The nginx plugin is not working; there may be problems with your existing configuration.

Check your nginx config with:  
`nginx -t`

---

<div class="post-metadata">

### Author: ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)
#### Post date: [January 29, 2019, 7:35pm UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/3 "2019-01-29T19:35:22Z")

</div>

> [@asbern](#):
>
> The error was: NoInstallationError(). Skipping.

Does it provide the rest of the error message?

Or does `/var/log/letsencrypt/letsencrypt.log`?

This probably means that the `nginx` executable isn't in the `PATH`, or -- less likely -- that Certbot can't find `nginx.conf`.

Check where `nginx` is -- e.g. with `which nginx` -- and make sure it's within the `PATH` used by cron.

---

<div class="post-metadata">

### Author: ![asbern](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@asbern](https://community.letsencrypt.org/u/asbern)
#### Post date: [January 30, 2019, 4:44am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/4 "2019-01-30T04:44:22Z")

</div>

Below is the output when i use nginx -t command

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok  
nginx: configuration file /etc/nginx/nginx.conf test is successful

---

<div class="post-metadata">

### Author: ![asbern](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@asbern](https://community.letsencrypt.org/u/asbern)
#### Post date: [January 30, 2019, 4:57am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/5 "2019-01-30T04:57:07Z")

</div>

The error message from letsencrypt.log

2019-01-18 00:18:49,930:DEBUG:certbot.main:certbot version: 0.26.1  
2019-01-18 00:18:49,930:DEBUG:certbot.main:Arguments:   
2019-01-18 00:18:49,930:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)  
2019-01-18 00:18:49,970:DEBUG:certbot.log:Root logging level set at 20  
2019-01-18 00:18:49,971:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log  
2019-01-18 00:18:50,015:DEBUG:certbot.plugins.selection:Requested authenticator \<certbot.cli.\_Default object at 0x7fa9ae03d650\> and installer \<certbot.cli.\_Default object at 0x7fa9ae03d650\>  
2019-01-18 00:18:50,036:DEBUG:certbot.storage:Should renew, less than 30 days before certificate expiry 2019-02-07 09:24:09 UTC.  
2019-01-18 00:18:50,036:INFO:certbot.renewal:Cert is due for renewal, auto-renewing…  
2019-01-18 00:18:50,037:DEBUG:certbot.plugins.selection:Requested authenticator nginx and installer nginx  
2019-01-18 00:18:50,038:DEBUG:certbot.plugins.disco:No installation (PluginEntryPoint#nginx):  
Traceback (most recent call last):  
File “/usr/lib/python2.7/site-packages/certbot/plugins/disco.py”, line 132, in prepare  
self.\_initialized.prepare()  
File “/usr/lib/python2.7/site-packages/certbot\_nginx/configurator.py”, line 139, in prepare  
raise errors.NoInstallationError  
NoInstallationError  
2019-01-18 00:18:50,051:DEBUG:certbot.plugins.selection:No candidate plugin  
2019-01-18 00:18:50,052:DEBUG:certbot.plugins.selection:No candidate plugin  
2019-01-18 00:18:50,052:DEBUG:certbot.plugins.selection:Selected authenticator None and installer None  
2019-01-18 00:18:50,052:INFO:certbot.main:Could not choose appropriate plugin: The nginx plugin is not working; there may be problems with your existing configuration.  
The error was: NoInstallationError()  
2019-01-18 00:18:50,052:WARNING:certbot.renewal:Attempting to renew cert ([www.example.com](http://www.example.com)) from /etc/letsencrypt/renewal/www.example.com.conf produced an unexpected error: The nginx plugin is not working; there may be problems with your existing configuration.  
The error was: NoInstallationError(). Skipping.  
2019-01-18 00:18:50,055:DEBUG:certbot.renewal:Traceback was:  
Traceback (most recent call last):  
File “/usr/lib/python2.7/site-packages/certbot/renewal.py”, line 430, in handle\_renewal\_request  
main.renew\_cert(lineage\_config, plugins, renewal\_candidate)  
File “/usr/lib/python2.7/site-packages/certbot/main.py”, line 1191, in renew\_cert  
installer, auth = plug\_sel.choose\_configurator\_plugins(config, plugins, “certonly”)  
File “/usr/lib/python2.7/site-packages/certbot/plugins/selection.py”, line 237, in choose\_configurator\_plugins  
diagnose\_configurator\_problem(“authenticator”, req\_auth, plugins)  
File “/usr/lib/python2.7/site-packages/certbot/plugins/selection.py”, line 341, in diagnose\_configurator\_problem  
raise errors.PluginSelectionError(msg)  
PluginSelectionError: The nginx plugin is not working; there may be problems with your existing configuration.  
The error was: NoInstallationError()

2019-01-18 00:18:50,055:ERROR:certbot.renewal:All renewal attempts failed. The following certs could not be renewed:  
2019-01-18 00:18:50,055:ERROR:certbot.renewal: /etc/letsencrypt/live/www.example.com/fullchain.pem (failure)  
2019-01-18 00:18:50,055:DEBUG:certbot.log:Exiting abnormally:  
Traceback (most recent call last):  
File “/usr/bin/certbot”, line 9, in   
load\_entry\_point(‘certbot==0.26.1’, ‘console\_scripts’, ‘certbot’)()  
File “/usr/lib/python2.7/site-packages/certbot/main.py”, line 1364, in main  
return config.func(config, plugins)  
File “/usr/lib/python2.7/site-packages/certbot/main.py”, line 1276, in renew  
renewal.handle\_renewal\_request(config)  
File “/usr/lib/python2.7/site-packages/certbot/renewal.py”, line 455, in handle\_renewal\_request  
len(renew\_failures), len(parse\_failures)))  
Error: 1 renew failure(s), 0 parse failure(s)

---

<div class="post-metadata">

### Author: ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)
#### Post date: [January 30, 2019, 5:04am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/6 "2019-01-30T05:04:05Z")

</div>

Ah! That's what I said it probably was:

> [@mnordhoff](#):
>
> This probably means that the `nginx` executable isn’t in the `PATH`

> [@mnordhoff](#):
>
> Check where `nginx` is – e.g. with `which nginx` – and make sure it’s within the `PATH` used by cron.

A newer version of Certbot added a more clear error message.

> <https://github.com/certbot/certbot/blob/v0.30.2/certbot-nginx/certbot_nginx/configurator.py#L142-L146>

---

<div class="post-metadata">

### Author: ![asbern](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@asbern](https://community.letsencrypt.org/u/asbern)
#### Post date: [January 30, 2019, 5:22am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/7 "2019-01-30T05:22:05Z")

</div>

How to change nginx path? any idea on that?

---

<div class="post-metadata">

### Author: ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [January 30, 2019, 5:26am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/8 "2019-01-30T05:26:28Z")

</div>

Show:  
`set | grep -i 'path='`  
`which nginx`

---

<div class="post-metadata">

### Author: ![asbern](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@asbern](https://community.letsencrypt.org/u/asbern)
#### Post date: [January 30, 2019, 5:28am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/9 "2019-01-30T05:28:27Z")

</div>

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin

---

<div class="post-metadata">

### Author: ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [January 30, 2019, 5:32am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/10 "2019-01-30T05:32:01Z")

</div>

The PATH looks OK.

Please show all of these:

- `which nginx`
- `crontab -l`
- `sudo crontab -l`
- `systemctl list-timers --all | grep certbot`

---

<div class="post-metadata">

### Author: ![asbern](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@asbern](https://community.letsencrypt.org/u/asbern)
#### Post date: [January 30, 2019, 5:37am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/11 "2019-01-30T05:37:13Z")

</div>

# which nginx

/usr/sbin/nginx

# crontab -l

0 0,12 \* \* \* python -c ‘import random; import time; time.sleep(random.random() \* 3600)’ && certbot renew

# systemctl list-timers --all | grep certbot

No output was shown for this

---

<div class="post-metadata">

### Author: ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [January 30, 2019, 5:43am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/12 "2019-01-30T05:43:11Z")

</div>

NGINX is in the PATH (for root user).

> [@asbern](#):
>
> **/usr/sbin** /nginx

> [@asbern](#):
>
> PATH=/usr/local/sbin:/usr/local/bin: **/usr/sbin** :/usr/bin:/root/bin

Try [one of these should work]:  
`certbot renew --dry-run --nginx-ctl /usr/sbin/nginx`  
or  
`certbot renew --dry-run --nginx-ctl /usr/sbin`

OR it will give us more clues...

---

<div class="post-metadata">

### Author: ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)
#### Post date: [January 30, 2019, 5:45am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/13 "2019-01-30T05:45:24Z")

</div>

Cron could be operating with a different `PATH`.

I can’t say what your cron daemon’s default `PATH` is or what the best way to change it is, though.

---

<div class="post-metadata">

### Author: ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [January 30, 2019, 5:54am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/14 "2019-01-30T05:54:33Z")

</div>

> [@mnordhoff](#):
>
> Cron could be operating with a different `PATH` .

Yeah - very possible.  
Not even sure how to get that "value" out...

---

<div class="post-metadata">

### Author: ![asbern](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@asbern](https://community.letsencrypt.org/u/asbern)
#### Post date: [January 30, 2019, 6:21am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/15 "2019-01-30T06:21:11Z")

</div>

# certbot renew --dry-run --nginx-ctl /usr/sbin

Saving debug log to /var/log/letsencrypt/letsencrypt.log

* * *

Processing /etc/letsencrypt/renewal/www.example.com.conf

* * *

Cert not due for renewal, but simulating renewal for dry run  
Could not choose appropriate plugin: The nginx plugin is not working; there may be problems with your existing configuration.  
The error was: NoInstallationError(“Could not find a usable ‘nginx’ binary. Ensure nginx exists, the binary is executable, and your PATH is set correctly.”,)  
Attempting to renew cert ([www.example.com](http://www.example.com)) from /etc/letsencrypt/renewal/www.example.com.conf produced an unexpected error: The nginx plugin is not working; there may be problems with your existing configuration.  
The error was: NoInstallationError(“Could not find a usable ‘nginx’ binary. Ensure nginx exists, the binary is executable, and your PATH is set correctly.”,). Skipping.  
All renewal attempts failed. The following certs could not be renewed:  
/etc/letsencrypt/live/www.example.com/fullchain.pem (failure)

* * *

\*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry  
\*\* (The test certificates below have not been saved.)

All renewal attempts failed. The following certs could not be renewed:  
/etc/letsencrypt/live/www.example.com/fullchain.pem (failure)  
\*\* DRY RUN: simulating ‘certbot renew’ close to cert expiry  
\*\* (The test certificates above have not been saved.)

* * *

1 renew failure(s), 0 parse failure(s)

#certbot renew --dry-run --nginx-ctl /usr/sbin/nginx  
was working fine, certificate renewed successfully

---

<div class="post-metadata">

### Author: ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)
#### Post date: [March 1, 2019, 6:21am UTC](https://community.letsencrypt.org/t/certbot-auto-renewal/84545/16 "2019-03-01T06:21:14Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
