Moving from apache to dns-01 w/cloudflare?

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: mdt.fyi

I ran this command: n/a

It produced this output: n/a

My web server is (include version): Apache

The operating system my web server runs on is (include version): Debian 12

My hosting provider, if applicable, is: n/a

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): version = 4.0.0

--
Perhaps a simple question. I am not sure. Originally I set up using --apache and in my /etc/letsencrypt/renewal folder I have a conf file that looks like this:

renew_before_expiry = 30 days

version = 4.0.0
archive_dir = /etc/letsencrypt/archive/mx.mdt.fyi
cert = /etc/letsencrypt/live/mx.mdt.fyi/cert.pem
privkey = /etc/letsencrypt/live/mx.mdt.fyi/privkey.pem
chain = /etc/letsencrypt/live/mx.mdt.fyi/chain.pem
fullchain = /etc/letsencrypt/live/mx.mdt.fyi/fullchain.pem

Options used in the renewal process

[renewalparams]
account = [redacted]
renew_hook = /root/bin/certbot-renew
authenticator = apache
server = https://acme-v02.api.letsencrypt.org/directory
installer = apache
key_type = rsa
dns_cloudflare_propagation_seconds = 30
dns_cloudflare_credentials = /root/.hidden/cloudflare.ini

--

LetsDebug does pass.
This command does work. "certbot certonly --dry-run --dns-cloudflare --dns-cloudflare-credentials /root/.secrets/cloudflare.ini -d mx.mdt.fyi --dns-cloudflare-propagation-seconds 90"

But I do not know exactly what I can do with this /etc/letsencrypt/renewal/ conf file. Can I delete it? If I want Certbot to run automatically, what do I need to change within this file to let it keep working?
Is there a better way to accomplish this? I can remove/reinstall Certbot if that's the best way.

2

That renewal config file is used by Certbot's renew command. This renew is usually setup to run as a cronjob or systemd timer when you install Certbot. Pretty sure on Debian it would be a timer. See: User Guide — Certbot 4.1.0.dev0 documentation

No, do not delete it. In general, don't manually modify any file within Certbot's folder structure.

A way to test renewal is:

sudo certbot renew --dry-run
2 Likes
3

If you re-run that command without --dry-run it should get a new certificate and update the /renewal config file with these new options.

The renewal config file reflects the most recently used options to get a production cert. It is not updated when using --dry-run to test.

Based on the existing renewal config it looks like you used a --deploy-hook. If you still want one make sure to include it on your new command.

4 Likes