Letsencrypt renew does nut update due certificates

Help
1

Please fill out the fields below so we can help you better.

My domain is:dev.volunteerly.org (multiple domains)

I ran this command:letsencrypt renew

It produced this output:
root@ubuntu:~# letsencrypt renew
Processing /etc/letsencrypt/renewal/dev.volunteerly.org.conf
Processing /etc/letsencrypt/renewal/myadmin.secure.volunteerly.org.conf
Processing /etc/letsencrypt/renewal/fb.secure.volunteerly.org.conf
Processing /etc/letsencrypt/renewal/webmail.tp3.dk.conf

The following certs are not due for renewal yet:
/etc/letsencrypt/live/dev.volunteerly.org/fullchain.pem (skipped)
/etc/letsencrypt/live/myadmin.secure.volunteerly.org/fullchain.pem (skipped)
/etc/letsencrypt/live/fb.secure.volunteerly.org/fullchain.pem (skipped)
/etc/letsencrypt/live/webmail.tp3.dk/fullchain.pem (skipped)
No renewals were attempted.
root@ubuntu:~#

My operating system is (include version):Ubuntu 16.04 server

My web server is (include version): Apache/Nginx (ServerPilot setup)

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

Several of my certificates will expire on 31. january 2017 but still the letsencrypt renew command returns “not due” for any of the certificates.

I installed https://github.com/lesaff/serverpilot-letsencrypt on the server and the certificates works like a charm. (and thank you for that!) - but the renewal process fails.

Looking forward to your response.

Best regards,
Mark

2

Hi Mark,

letsencrypt renew appears to have worked correctly ( new certificates were obtained for dev.volunteerly.org earlier this month - see https://crt.sh/?q=%volunteerly.org )

however you aren’t using the latest certificates that you have in your nginx. This could be for a couple of reasons.

  1. You simply need to reload nginx to use the correct certificates.

  2. You’re nginx config points to the certs at a different location than in /etc/letsencrypt/live… in which case you need to update that before reloading nginx.

1 Like
3

Thanks for your quick reply!
I’ll have a look to see if my Nginx settings are correct, the server has been rebooted in the last month or so, so the new certs should have loaded.

Thanks again :slight_smile:

4

The latest cert for dev.volunteerly.org was on the 1st Jan

Not Before: Jan 1 16:00:00 2017 GMT
Not After : Apr 1 16:00:00 2017 GMT

so would need to have been restarted this month.

It looks as if you have reloaded nginx, as your server is now using the updated certs.

5

I reloaded nginx-sp and now the corrects certs are used.
So was 1.117 the first reissue of the certificates ?

(wondering if I need to implement some kind of server restart to avoid this in the future)

1 Like
6

Setup a cron job to do it all for you including reloading your web server.

7

no - you can see the dates of the certs at crt.sh | %volunteerly.org

I'd suggest something like ...

letsencrypt renew --post-hook "service nginx reload"

1 Like
8

As far as I can tell (and remember) the cert was issued nov. 2. 16 and would expire jan. 31. 17.
It would appear as if I should implement a automatic restart of Nginx service once a month.

Thanks for your great service!

9

@serverco thanks that https://crt.sh/ is a very useful tool to add to the collection :+1:

1 Like
10

The other transparency report I find useful is google - https://www.google.com/transparencyreport/https/ct/?hl=en (usually a faster response, although doesn’t have as much detail)

1 Like
11

Cool stuff, thanks :wink:

12

@serverco Will the --post-hook “service nginx-sp reload” fire even if no certs was updated ?

13

No, It should only run when a cert is renewed. From the documentation

–post-hook POST_HOOK
Command to be run in a shell after attempting to obtain/renew certificates. Can be used to deploy renewed certificates, or to restart any servers that were stopped by --pre-hook. This is only run if an attempt was made to obtain/renew a certificate.

1 Like
14

I think as @serverco mentioned to me via PM, running it as a cron as follows is better as it will not reload nginx or apache unless a renewal was done.

so then as simple as crontab -e

00 20 * * * sudo /opt/certbot/certbot-auto renew --quiet --post-hook "service nginx reload" ```

or

```MAILTO=youremail@wherever.com
00 20 * * * sudo /opt/certbot/certbot-auto renew --quiet --post-hook "service apache2 reload" ```
15

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.