# Certbot + post hook + vsftpd
**URL:** https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159
**Category:** Help
**Created:** [November 2, 2022, 1:44pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159 "2022-11-02T13:44:55Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@g-spencer](https://community.letsencrypt.org/u/g-spencer)
#### Post date: [November 2, 2022, 1:44pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/1 "2022-11-02T13:44:55Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: [ftps.sis.tv](http://ftps.sis.tv)
I ran this command:N/A
It produced this output:N/A
My web server is (include version):vsftpd-3.0.3-33
The operating system my web server runs on is (include version):RedHat 8.4
My hosting provider, if applicable, is: Azure
I can login to a root shell on my machine (yes or no, or I don't know):yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): ni
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):certbot 1.14.0
I previously reported my issue at: [Certbot + post hook + vsftpd](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/179828)
the recommendation was to use a script as post hook.
that still hasn't resolved my issue, the cert renewal fails to call the post hook
extract from log at time of cert renewal:
2022-09-16 10:48:39,062:DEBUG:certbot.display.util:Notifying user: new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/ftps.sis.tv/fullchain.pem
2022-09-16 10:48:39,063:DEBUG:certbot.\_internal.plugins.selection:Requested authenticator standalone and installer None
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [November 2, 2022, 2:19pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/2 "2022-11-02T14:19:04Z")
> [@g-spencer](#):
>
> the cert renewal fails to call the post hook
I'm not seeing that from the tiny part of the log file you've posted. The words about not reloading is probably related to the nginx and apache plugins when using the certonly subcommand.
Can you post the related renewal configuration file?
---
### Author:  [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)
#### Post date: [November 2, 2022, 2:26pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/3 "2022-11-02T14:26:06Z")
Which [Challenge Types - Let's Encrypt](https://letsencrypt.org/docs/challenge-types/) are you using?
Using [https://letsdebug.net/](https://letsdebug.net/) all 3 Challenge Types either have ERRORS or WARNINGS
1. HTTP ~~S~~ -01 [Let's Debug](https://letsdebug.net/ftps.sis.tv/1247749)
2. DNS-01 [Let's Debug](https://letsdebug.net/ftps.sis.tv/1247753)
3. TLS-ALPN-01 [Let's Debug](https://letsdebug.net/ftps.sis.tv/1247755)
[Best Practice - Keep Port 80 Open](https://letsencrypt.org/docs/allow-port-80/)
---
### Author:  [@g-spencer](https://community.letsencrypt.org/u/g-spencer)
#### Post date: [November 2, 2022, 3:00pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/4 "2022-11-02T15:00:23Z")
Hi Bruce,
I'm using HTTPS-01.
Hi Osiris,
the renewal files are:-
"/etc/systemd/system/certbot-renewal.service"
which currently contains:-
"[Unit]
Description=Certbot Renewal
[Service]
ExecStart=/usr/bin/certbot renew --post-hook "/root/scripts/vsftpd-restart.sh"
"
and that post-hook script file contains:-
"#!/bin/sh
/usr/bin/systemctl status vsftpd.service
/usr/bin/systemctl restart vsftpd.service
/usr/bin/systemctl status vsftpd.service"
the permissions on the script file are:-
"-r-xr-----. 1 root root 324 Jun 30 11:32 /root/scripts/vsftpd-restart.sh
"
so it has execute permission, and it runs when called manually from the command line.
---
### Author:  [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)
#### Post date: [November 2, 2022, 3:08pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/5 "2022-11-02T15:08:34Z")
> [@g-spencer](#):
>
> I'm using HTTPS-01.
You will **need** [Best Practice - Keep Port 80 Open](https://letsencrypt.org/docs/allow-port-80/)
> [@Bruce5051](#):
>
> HTTP ~~S~~ -01 [Let's Debug](https://letsdebug.net/ftps.sis.tv/1247749)
---
### Author:  [@g-spencer](https://community.letsencrypt.org/u/g-spencer)
#### Post date: [November 2, 2022, 3:11pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/6 "2022-11-02T15:11:20Z")
Hi Bruce,
I don't want to wander up that avenue unnecessarily.
the actual cert is renewing fine, what is not happening is the ftp application is not being bounced as part of post hook, so the old certificate is still being used by the ftp server application, even though a new certificate is obtained by certbot.
---
### Author:  [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)
#### Post date: [November 2, 2022, 3:14pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/7 "2022-11-02T15:14:12Z")
> [@g-spencer](#):
>
> the actual cert is renewing fine
Thanks, that is good to know; as often I cannot see the forest through the trees. 🤪
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [November 2, 2022, 3:31pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/8 "2022-11-02T15:31:26Z")
@g-spencer Osiris meant for you to show the renewal file for that cert in `/etc/letsencrypt/renewal`
---
### Author:  [@g-spencer](https://community.letsencrypt.org/u/g-spencer)
#### Post date: [November 2, 2022, 4:00pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/9 "2022-11-02T16:00:15Z")
Hi MikeMcQ,
as requested:-
`cat /etc/letsencrypt/renewal/ftps.sis.tv.conf`
```nohighlight
# renew_before_expiry = 30 days
version = 1.14.0
archive_dir = /etc/letsencrypt/archive/ftps.sis.tv
cert = /etc/letsencrypt/live/ftps.sis.tv/cert.pem
privkey = /etc/letsencrypt/live/ftps.sis.tv/privkey.pem
chain = /etc/letsencrypt/live/ftps.sis.tv/chain.pem
fullchain = /etc/letsencrypt/live/ftps.sis.tv/fullchain.pem
# Options used in the renewal process
[renewalparams]
account = 9fdf...ba1f
pref_challs = http-01,
authenticator = standalone
server = https://acme-v02.api.letsencrypt.org/directory
post_hook = systemctl restart postfix
```
---
### Author:  [@Osiris](https://community.letsencrypt.org/u/Osiris)
#### Post date: [November 2, 2022, 4:48pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/10 "2022-11-02T16:48:06Z")
So no vsftpd post/deploy hook is actually configured, only Postfix. No wonder it doesn't work.
Usually, one would not use the post hook command from within a systemd timer, but configure Certbot properly so that the renewal configuration file contains the appropriate command.
---
### Author:  [@g-spencer](https://community.letsencrypt.org/u/g-spencer)
#### Post date: [November 2, 2022, 4:56pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/11 "2022-11-02T16:56:16Z")
OK thanks for highlighting that, I originally set it up to restart postfix as part of the testing.
I'll look at getting the correct configuration, do I just edit the file ?
thanks,
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [November 3, 2022, 3:51am UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/12 "2022-11-03T03:51:49Z")
> [@g-spencer](#):
>
> I'm using HTTPS-01.
That can't be right.
---
### Author:  [@g-spencer](https://community.letsencrypt.org/u/g-spencer)
#### Post date: [November 3, 2022, 9:17am UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/13 "2022-11-03T09:17:00Z")
why'd you say that?
from my understanding, certbot starts an http listener only for the renewal process and then shuts down again
---
### Author:  [@g-spencer](https://community.letsencrypt.org/u/g-spencer)
#### Post date: [November 3, 2022, 10:33am UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/14 "2022-11-03T10:33:39Z")
I've updated /etc/letsencrypt/renewal config file.
will monitor and report on future findings,
thanks Osiris / MikeMcQ
---
### Author:  [@g-spencer](https://community.letsencrypt.org/u/g-spencer)
#### Post date: [November 3, 2022, 2:34pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/15 "2022-11-03T14:34:19Z")
actually, I've just dry-runned the renewal and vsftpd service has been restarted:-
certbot renew --dry-run
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [November 3, 2022, 5:12pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/16 "2022-11-03T17:12:38Z")
> [@g-spencer](#):
>
> why'd you say that?
Because there is no active `HTTPS-01` authentication method allowed.
I think you must have meant `HTTP-01`.
---
### Author:  [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)
#### Post date: [November 3, 2022, 5:17pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/17 "2022-11-03T17:17:13Z")
> [@rg305](#):
>
> Because there is no active `HTTPS-01` authentication method allowed.
> I think you must have meant `HTTP-01`.
That could be my fault for previously using HTTPS-01 in this Topic when I meant HTTP-01, sorry. ☹
I think I have edited them to be HTTP ~~S~~ -01 now.
---
### Author:  [@rg305](https://community.letsencrypt.org/u/rg305)
#### Post date: [November 3, 2022, 5:58pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/18 "2022-11-03T17:58:07Z")
> [@g-spencer](#):
>
> `post_hook`
Could that be "`deploy_hook`"?
---
### Author:  [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)
#### Post date: [November 3, 2022, 6:55pm UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/19 "2022-11-03T18:55:25Z")
> [@rg305](#):
>
> Could that be "`deploy_hook`"?
Yes, agreed probably better hook. Just noting it is `--deploy-hook` in command prompt but translates to `renew_hook` in renewal conf file.
---
### Author:  [@g-spencer](https://community.letsencrypt.org/u/g-spencer)
#### Post date: [November 4, 2022, 9:46am UTC](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159/20 "2022-11-04T09:46:38Z")
Hi Bruce5051,
yes, sorry, HTTP-01 for the challenge, not HTTPS-01 (well spotted)
rg305 / MikeMcQ,
as for the conf file, the parameter specified in my conf file is 'post\_hook', I don't know if that's 'better practice', but seemed to work for the dummy run.
[Next page](https://community.letsencrypt.org/t/certbot-post-hook-vsftpd/187159.md?page=2)