LetsEncrypt + DANE

[AfroThundr]

@Quantum

So far, so good. Now I have my LE certs in place, but how to renew? I needed certonly, to get my initial certs with a custom --csr, so I doubt that certbot will be happy with a simple run. (although it does work with --dryrun) My understanding is that certs fetched with certonly, can not be renewed with a run.

Assuming that is not true, I can just update with a regular run and --csr to specify the same cert over and over so DANE doesn’t get upset.

Assuming the above is true, I’ll need to make a script of some sort.

You are indeed correct that you need certonly in order to do the renewal with a custom CSR.

As for auto renew scripts, as I posted in an earlier thread, you might try mine or any of several other examples online to see if they can be modified to suit your needs.