How to correctly add auto-renewal (Debian 9 (Stretch))

Help
1

I would like to create automatic renwal for my domains, because i Have had some bad luck in the past without looking into it I have made some mistakes that cost me dearly.
I would like to know if there is a tutorial or something similar to recommend me so i don’t mess everything up. Thank you.

My domain is: www.elami.mk

My web server is (include version):
Distributor ID: Debian
Description: Debian GNU/Linux 9.9 (stretch)
Release: 9.9
Codename: stretch

The operating system my web server runs on is (include version):
Apache/2.4.25 (Debian)

I can login to a root shell on my machine (yes or no, or I don’t know): YES

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
No, I use terminal

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):
certbot 0.40.1 (cannot find where is located)

2

which certbot
find / -name certbot

Please show:
systemctl status certbot
systemctl list-timers certbot.timer

3

which certbot
find / -name certbot

/opt/letsencrypt/certbot
/opt/eff.org/certbot
/opt/eff.org/certbot/venv/bin/certbot
/opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot

systemctl status certbot
systemctl list-timers certbot.timer

systemctl status certbot
Unit certbot.service could not be found.

systemctl list-timers certbot.timer
0 timers listed.
Pass --all to see loaded but inactive timers, too.

4

Please show:
find / -name certbot*
systemctl list-timers

#use your actual root username:
crontab -u root -l

EDIT: be sure to be logged as root user or use sudo for these commands

5

find / -name certbot*

/opt/letsencrypt/docs/man/certbot.rst
/opt/letsencrypt/certbot-ci
/opt/letsencrypt/certbot-ci/certbot_integration_tests
/opt/letsencrypt/certbot-ci/certbot_integration_tests/utils/certbot_call.py
/opt/letsencrypt/certbot-ci/certbot_integration_tests/certbot_tests
/opt/letsencrypt/certbot-dns-luadns
/opt/letsencrypt/certbot-dns-luadns/certbot_dns_luadns
/opt/letsencrypt/certbot-dns-cloudflare
/opt/letsencrypt/certbot-dns-cloudflare/certbot_dns_cloudflare
/opt/letsencrypt/certbot-apache
/opt/letsencrypt/certbot-apache/certbot_apache
/opt/letsencrypt/certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/ multiple_vhosts/apache2/sites-available/certbot.conf
/opt/letsencrypt/certbot-apache/certbot_apache/tests/testdata/debian_apache_2_4/ multiple_vhosts/apache2/sites-enabled/certbot.conf
/opt/letsencrypt/certbot-dns-route53
/opt/letsencrypt/certbot-dns-route53/certbot_dns_route53
/opt/letsencrypt/certbot
/opt/letsencrypt/certbot-auto
/opt/letsencrypt/certbot-dns-google
/opt/letsencrypt/certbot-dns-google/certbot_dns_google
/opt/letsencrypt/certbot-nginx
/opt/letsencrypt/certbot-nginx/certbot_nginx
/opt/letsencrypt/certbot-dns-gehirn
/opt/letsencrypt/certbot-dns-gehirn/certbot_dns_gehirn
/opt/letsencrypt/certbot-dns-dnsmadeeasy
/opt/letsencrypt/certbot-dns-dnsmadeeasy/certbot_dns_dnsmadeeasy
/opt/letsencrypt/certbot-compatibility-test
/opt/letsencrypt/certbot-compatibility-test/certbot_compatibility_test
/opt/letsencrypt/certbot-dns-rfc2136
/opt/letsencrypt/certbot-dns-rfc2136/certbot_dns_rfc2136
/opt/letsencrypt/certbot-dns-ovh
/opt/letsencrypt/certbot-dns-ovh/certbot_dns_ovh
/opt/letsencrypt/certbot-dns-dnsimple
/opt/letsencrypt/certbot-dns-dnsimple/certbot_dns_dnsimple
/opt/letsencrypt/certbot-dns-digitalocean
/opt/letsencrypt/certbot-dns-digitalocean/certbot_dns_digitalocean
/opt/letsencrypt/letsencrypt-auto-source/certbot-auto.asc
/opt/letsencrypt/letsencrypt-auto-source/pieces/certbot-requirements.txt
/opt/letsencrypt/windows-installer/certbot.ico
/opt/letsencrypt/examples/plugins/certbot_example_plugins.py
/opt/letsencrypt/certbot-dns-sakuracloud
/opt/letsencrypt/certbot-dns-sakuracloud/certbot_dns_sakuracloud
/opt/letsencrypt/certbot-dns-linode
/opt/letsencrypt/certbot-dns-linode/certbot_dns_linode
/opt/letsencrypt/certbot-dns-cloudxns
/opt/letsencrypt/certbot-dns-cloudxns/certbot_dns_cloudxns
/opt/letsencrypt/certbot-dns-nsone
/opt/letsencrypt/certbot-dns-nsone/certbot_dns_nsone
/opt/eff.org/certbot
/opt/eff.org/certbot/venv/bin/certbot
/opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot_nginx-0.40.1.dist- info
/opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot_apache-0.40.1.dist -info
/opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot_nginx
/opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot
/opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot-0.40.1.dist-info
/opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot_apache
/opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot_apache/tests/testd ata/debian_apache_2_4/multiple_vhosts/apache2/sites-available/certbot.conf
/opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot_apache/tests/testd ata/debian_apache_2_4/multiple_vhosts/apache2/sites-enabled/certbot.conf
/opt/eff.org/certbot/venv/certbot-auto-bootstrap-version.txt
/usr/local/sbin/certbot-auto

systemctl list-timers
NEXT LEFT LAST PASSED UNIT ACTIVATES
Thu 2019-11-07 11:39:00 UTC 5min left Thu 2019-11-07 11:09:02 UTC 24min ago phpsessionclean.timer phpsessionclean.service
Thu 2019-11-07 14:47:11 UTC 3h 13min left Wed 2019-11-06 14:47:11 UTC 20h ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Thu 2019-11-07 17:18:39 UTC 5h 45min left Thu 2019-11-07 05:44:48 UTC 5h 48min ago apt-daily.timer apt-daily.service
Fri 2019-11-08 06:11:31 UTC 18h left Thu 2019-11-07 06:04:35 UTC 5h 28min ago apt-daily-upgrade.timer apt-daily-upgrade.service

4 timers listed.
Pass --all to see loaded but inactive timers, too.

sudo crontab -u root -l

no crontab for root

6

OK, so your running certbot-auto
But there was not timer automatically created for renewals...
[that should have been done for you]

7

OK, the simplest is to use cron
What command are you currently using to renew?

8

I still havent needed to renew, the websites are younger than 90 days and just wanted to prepare ahead of time and set up automatic renewal and not mess anything up along the way,

9

OK.
Here is a starting point for your cron renewal entry:

41 */12 * * * /usr/local/sbin/certbot-auto --apache -q --deploy-hook '/etc/init.d/apache2 restart'

Test that with:
/usr/local/sbin/certbot-auto --apache --deploy-hook '/etc/init.d/apache2 restart'

10

I just copy all of this into terminal and run ?

11

From cron job NO
That requires using an editor (via crontab -e)
[https://www.ostechnix.com/a-beginners-guide-to-cron-jobs/]

Start with the TEST command first - see if that "works".
Try from terminal prompt:

sudo /usr/local/sbin/certbot-auto --apache --deploy-hook '/etc/init.d/apache2 restart'
12

I copy this command exactly like this and run it as sudo su ?

13

YES

14

sudo /usr/local/sbin/certbot-auto --apache --deploy-hook ’ /etc/init.d/apache2 restart’
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache

Which names would you like to activate HTTPS for?

1: elami.mk
2: www.elami.nl
3: www.elami.mk

Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter ‘c’ to cancel): An unexpected error occ urred:
error: (4, ‘Interrupted system call’)
Please see the logfiles in /var/log/letsencrypt for more details.

15

So you don’t yet have a certificate?
Enter “c” and cancel that.

Show:
certbot-auto certificates

16

certbot-auto certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Found the following certs:
Certificate Name: elami.mk
Domains: elami.mk www.elami.mk
Expiry Date: 2019-12-10 10:18:04+00:00 (VALID: 32 days)
Certificate Path: /etc/letsencrypt/live/elami.mk/fullchain.pem
Private Key Path: /etc/letsencrypt/live/elami.mk/privkey.pem
Certificate Name: justsayingkiddo.nl
Domains: justsayingkiddo.nl www.justsayingkiddo.nl
Expiry Date: 2019-12-10 10:52:58+00:00 (VALID: 32 days)
Certificate Path: /etc/letsencrypt/live/justsayingkiddo.nl/fullchain.pem
Private Key Path: /etc/letsencrypt/live/justsayingkiddo.nl/privkey.pem
Certificate Name: kentivo.de
Domains: kentivo.de
Expiry Date: 2019-12-12 10:45:26+00:00 (VALID: 34 days)
Certificate Path: /etc/letsencrypt/live/kentivo.de/fullchain.pem
Private Key Path: /etc/letsencrypt/live/kentivo.de/privkey.pem
Certificate Name: www.kentivo.de
Domains: www.kentivo.de kentivo.nl www.kentivo.nl
Expiry Date: 2019-12-12 10:34:56+00:00 (VALID: 34 days)
Certificate Path: /etc/letsencrypt/live/www.kentivo.de/fullchain.pem
Private Key Path: /etc/letsencrypt/live/www.kentivo.de/privkey.pem

EDIT: The other domains listed here were also listed up there but I deleted them because I thought they were not relevant, but they are apparently so they were on the list up there also.

17

Interesting…
You have certs, but certbot-auto doesn’t know where/how they are being used…

Please show:
ls -l /etc/letsencrypt/renewal/

18

ls -l /etc/letsencrypt/renewal/
total 16
-rw-r--r-- 1 root root 499 Sep 11 11:18 elami.mk.conf
-rw-r--r-- 1 root root 549 Sep 11 11:53 justsayingkiddo.nl.conf
-rw-r--r-- 1 root root 509 Sep 13 11:45 kentivo.de.conf
-rw-r--r-- 1 root root 529 Sep 13 11:34 www.kentivo.de.conf

19

Please show:
[don’t show account numbers]

cat /etc/letsencrypt/renewal/elami.mk.conf

20

cat /etc/letsencrypt/renewal/elami.mk.conf

renew_before_expiry = 30 days

version = 0.38.0
archive_dir = /etc/letsencrypt/archive/elami.mk
cert = /etc/letsencrypt/live/elami.mk/cert.pem
privkey = /etc/letsencrypt/live/elami.mk/privkey.pem
chain = /etc/letsencrypt/live/elami.mk/chain.pem
fullchain = /etc/letsencrypt/live/elami.mk/fullchain.pem

Options used in the renewal process

[renewalparams]
authenticator = apache
installer = apache
account =
server = https://acme-v02.api.letsencrypt.org/directory