How can I set the log file name for non-LE `certbot certonly` operations?

Help
1

certbot 4.0.0 via apt on Debian 13.

I'm running a battle-tested certbot certonly + Let's Encrypt for VPS certificates - no issues there at all, and it works really well.

I am looking into using alternate ACME CAs to load balance, compare & contrast etc. I am using certbot certonly + Actalis to test the water, like so:

sudo /usr/bin/certbot \
certonly \
--agree-tos \
--cert-name "$fqdn" \
--config-dir /etc/certbot/actalis.com/ \
--domains "$fqdn" \
--eab-kid "$eab_kid" \
--eab-hmac-key "$eab_hmac" \
--email "$eab_email" \
--logs-dir /var/log/certbot/actalis.com/ \
--noninteractive \
--server https://acme-api.actalis.com/acme/directory \
--webroot \
--webroot-path "$www_prefix"/www/heartbeat/_well-known \

All the variables are set prior to the certbot certonly run, and due to a CAA record typo on my part (I had it set to actalis.com when it should be actalis.it), I get the following error:

Saving debug log to /var/log/certbot/actalis.com/letsencrypt.log
Requesting a certificate for darwin.tlsvps.com
An unexpected error occurred:
Blocking CAA record(s) found on one or more of the specified domains
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/certbot/actalis.com/letsencrypt.log or re-run Certbot with -v for more details.

Note the letsencrypt.log filename. The directory path is correct, but the filename (letsencrypt.log) presumably uses its hard-coded default.

How can I set the log file name for non-LE certbot certonly operations?

I can't find anything in certbot --help all that relates to changing the filename. I'm sure I'm missing something obvious somewhere…and I'm getting snowblind.

I'd really appreciate any guidance or pointers on whether the log file can be renamed.

Thank you.

2

There are many things still left over in Certbot from when the only CA that could be used with it was Let's Encrypt (and when Let's Encrypt itself was more involved in development), and I think you're running into one of them. I don't think you can set the filename itself, only the --config-dir, --work-dir, and --logs-dir.

If it's really important to you, you might be able to edit the source code and run your own build (and/or submit a pull request to them). But that wouldn't be worth it to me.

Also, you may be reaching a level of complexity where some other client suits your needs better than certbot does. There are systems like Caddy that automatically use multiple CAs. You may want to explore alternatives, too, rather than trying to hammer certbot into what you're looking for. (Though certbot does do a lot and can be hammered into quite a bit.)

3

Received and understood - message gratefully received, @petercooperjr - thank you very much.