Certonly renewal with --manual; unable to specify absolute path to config directory

We are writing a script to automate our ‘manual’ certificate renewals, and are trying to decouple it from having to be run on a specific machine. The current procedure is:

  • Download an encrypted archive of the Let’s Encrypt config directory to a tmp directory
  • run certbot certonly (work-dir, logs-dir, cert-path, key-path, chain-path, fullchain-path, etc are all set to point to the new config directory location). We also have a validation and deploy script.
  • encrypt and backup the new state of the config directory.

Most of this works fine, and the certificates are renewed, however, they saved to the wrong location. Instead of being saved to the temporary config directory, they are saved to the original location the initial cert was generated at, i.e. a specific user’s home directory on a specific machine.

As far as I can tell, the config/renewal/[site].conf file is the cause of this issue — there are several paths in there that still point to the original location. I believe we are setting all of the flags we possibly can, but the one that doesn’t appear to have a flag is archive_dir. I’d rather not go down the route of dynamically re-writing this config file (especially since archive_dir isn’t a documented config option, so it’s not guaranteed to work with future versions).

Is there another recommended way to essentially move the absolute path to the config directory?

1 Like

So problem is that the Certbot --config-dir cannot be relocated due to its state relying on absolute paths? There’s a previous (unresolved) discussion of that issue here: https://github.com/certbot/certbot/issues/3953

It seems like, for now, the best you are going to get is to extract the configuration to the location that Certbot is expecting . e.g. using a consistent --config-dir every time, or creating a temporary symlink right before you run Certbot.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.