How does certbot decide the -000x suffix for certificate renewal

[Bruce5051]

Here is a link for assistance certbot — Certbot 2.7.0.dev0 documentation, which states:

  --force-renewal, --renew-by-default
                        If a certificate already exists for the requested
                        domains, renew it now, regardless of whether it is
                        near expiry. (Often --keep-until-expiring is more
                        appropriate). Also implies --expand. (default: False)

[April]

The service was written by someone else about 4 years ago
I joined last month and now running into this

[Osiris]

Personally, my first step would be to learn what every option does, but that's just me.

[rg305]

@April

If all the links are broken, it should have created -0005 ?

No.

If it was simply trying to "renew", it would not "create" anything "new".
Except for the weird case where you explicitly tell certbot to renew even when it can't validate all the names on the cert [see: --allow-subset-of-names].
When that happens, certbot will be forced into creating a new cert - because all the names are not being included in this new request.

@April

You mentioned not to use --force-renewal option unless we are absolutely sure that is the intent. What would it do ?

As already mentioned, the best place to answer these types of questions is in the docs:
User Guide — Certbot 2.7.0.dev0 documentation (eff-certbot.readthedocs.io)

[Osiris]

@rg305

Except for the weird case where you explicitly tell certbot to renew even when it can't validate all the names on the cert [see: --allow-subset-of-names].
When that happens, certbot will be forced into creating a new cert - because all the names are not being included in this new request.

I'm not so sure about that. As far as I know, it overwrites the existing certificate.

[rg305]

hmm...
That may be true.
[hard for me to say as I never use --allow-subset-of-names]

In any case, it would NOT do:

@April

If all the links are broken, it should have created -0005 ?

[April]

I didn't understand this. We are using certbot certonly command. When client requests for renewal, the option --force-renewal is appended to it.
So, you are saying that without --force-renewal , the suffix -0005 would be created ?
And if --force-renewal can't renew any cert due to broken links, it won't do anything, right ?

[rg305]

@April

So, you are saying that without --force-renewal , the suffix -0005 would be created ?

I don't think --force-renewal is causing the -000x numbers.
It only speeds up the (broken) renewal process by forcing it to happen immediately [not at the next regular schedule].

@April

And if --force-renewal can't renew any cert due to broken links, it won't do anything, right ?

Correct.

[April]

Thanks for clarifying this. So in my case certbot certonly would have created those suffixes when it found broken certificates.
I came across a similar thread and this one
What would be the behavior of certbot certonly if the certificate links aren't broken ?

[orangepizza]

you'd want certbot renew for renewals: certonly is for making new linage

[April]

The current service code is using certbot certonly and certbot certonly --force-renewal
I think it is not using certbot renew

[rg305]

That is bad coding.
It is partly to blame for all the -000x certs.

Once a cert has been created, you only need to renew it, with:
certbot renew

[Osiris]

@April

and certbot certonly --force-renewal

That should never have happened.