Limiting the number of renewals per certbot invoke

Client dev
8

You could do something more creative like split up the sorted list of certificates, modulo the number of days in the week.

#!/usr/bin/env bash

ALL_CERTS=$(find /etc/letsencrypt/renewal -type f -printf '%f\n' | sed 's/\.conf//' | sort -h)

TOTAL_TO_RENEW=$(echo "$ALL_CERTS" | wc -l)
TOTAL_PER_BATCH=$(awk "function ceil(x){return x%1 ? int(x)+1 : x} BEGIN {print ceil($TOTAL_TO_RENEW/7)}") # ceil so we dont skip any
TO_SKIP=$(($TOTAL_PER_BATCH * ($(date +%u)-1))) # floor so we dont skip any
THIS_BATCH=$(echo "$ALL_CERTS" | tail -n +$(($TO_SKIP + 1)) | head -n $TOTAL_PER_BATCH)

while read -r CERT; do
  echo "Renewing $CERT"
  certbot renew --cert-name "$CERT" --non-interactive
done <<< "$THIS_BATCH"

You’d need to double check it, but on each day, it would give a few attempts per day for each group of domains, and you should end up with a bunch of certificates staggered across days-of-week.

You could probably adjust it to 6 hour time intervals but using anything except integers in bash sucks!

3 Likes