Hello,
after having hit the issuance limit a few times, I decided that I should use the staging servers until I’m sure that something fully works (I’m working on automated deployments, not just on random personal websites, so I redeployed many times, and if something went wrong I often lost the previous certs).
So far so good, but I’ve got a grievance with certbot (or I don’t know which option I should use): if I launch it with “–staging”, then i launch it without such options when the staging certs already exist, it will refuse to create a new certificate (because it’s not yet due for renewal), unless I pass –force-renewal, but it won’t even exit with an error.
Now, this is a bit of an hassle; if I ask certbot to create or renew certs without the ‘staging’ options, I expect that, at the end of the operation, I get production, valid certificates; or, if I can’t get them, at least that certbot exits with a nonzero status to signify an error.
Such behaviour is problematic for automated systems, is there any way around?
Example:
suppose that I’m working on a new system. The “–staging” flag is set. Once development is done, I need to add a “–force-renewal” flag, make sure that all the existing systems are deployed - which can be difficult, maybe some system is not available at some moment - then I need to remove the flag (otherwise at each subsequent deployment I’ll renew a cert and hit the issuance limit). It seems to retain a state which isn’t useful IMHO.
Full example log follows:
(mycertbot)root@pilar:/tmp# certbot --config-dir /tmp/conf/ --work-dir /tmp/work/ --logs-dir /tmp/logs/ certonly --preferred-challenges=http --staging --standalone -n -m registrazioni@franzoni.eu --agree-tos -d pilar.franzoni.eu
Saving debug log to /tmp/logs/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Broadcast message from root@pilar
(unknown) at 17:00 ...
The system is going down for reboot in 540 minutes!
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for pilar.franzoni.eu
Waiting for verification...
Cleaning up challenges
Non-standard path(s), might not work with crontab installed by your operating system package manager
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/tmp/conf/live/pilar.franzoni.eu/fullchain.pem
Your key file has been saved at:
/tmp/conf/live/pilar.franzoni.eu/privkey.pem
Your cert will expire on 2018-02-14. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- Your account credentials have been saved in your Certbot
configuration directory at /tmp/conf. You should make a secure
backup of this folder now. This configuration directory will also
contain certificates and private keys obtained by Certbot so making
regular backups of this folder is ideal.
(mycertbot)root@pilar:/tmp# certbot --config-dir /tmp/conf/ --work-dir /tmp/work/ --logs-dir /tmp/logs/ certonly --preferred-challenges=http --standalone -n -m registrazioni@franzoni.eu --agree-tos -d pilar.franzoni.eu
Saving debug log to /tmp/logs/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Cert not yet due for renewal
Keeping the existing certificate
-------------------------------------------------------------------------------
Certificate not yet due for renewal; no action taken.
-------------------------------------------------------------------------------
IMPORTANT NOTES:
- Your account credentials have been saved in your Certbot
configuration directory at /tmp/conf. You should make a secure
backup of this folder now. This configuration directory will also
contain certificates and private keys obtained by Certbot so making
regular backups of this folder is ideal.
(mycertbot)root@pilar:/tmp# certbot --version
certbot 0.19.0