Multiple certs were not combined into one: will they auto-update?

[tophee]

Continuing the discussion from Migrating WordPress with HTTPs Secured by LetsEncrypt to New Server:

A lot of things have come up in the above topic and I don't blame anyone for not following it through 100% so I'm starting this as a new topic point because it seems like a fairly straightforward question: can I count on my certificates being automatically updated through this a weekly job that basically does letsencrypt renew (as described here even though they were strangely not combined into one certificate:

@jmorahan

That's odd; the command you posted above, sudo letsencrypt certonly -a webroot --webroot-path=/var/www/html -d mydomain.net -d www.mydomain.net -d forum.mydomain.net -d test.mydomain.net, would have attempted to obtain such a certificate. Are you sure it succeeded?

[schoen]

certbot renew will try to renew every certificate that’s in need of renewal, regardless of how many there are. It’s designed to be run often (at least once per day) because it tries to renew only when renewal becomes necessary (<30 days to expiry).

[tophee]

@schoen

certbot renew will try to renew every certificate that's in need of renewal, regardless of how many there are.

And that holds even when some of the certs were originally obtained via webroot and others via manual dns challenge?

@schoen

It's designed to be run often (at least once per day) because it tries to renew only when renewal becomes necessary (<30 days to expiry).

That doesn't make sense to me: if certs are renewed if time to expiry is less than 30 days, then 7 or even 9 days seems completely sufficient to make sure that they are renewed before they expire. If you had said that a daily check is better because the plan is to significantly reduce the duration of letsencrypt certs, then I would understand, but like this?

[schoen]

@tophee

And that holds even when some of the certs were originally obtained via webroot and others via manual dns challenge?

Unfortunately, I believe certificates obtained with "manual" can't be renewed by certbot renew at all. This might not be true with hooks, but I'll have to double-check.

[quote]That doesn't make sense to me: if certs are renewed if time to expiry is less than 30 days, then 7 or even 9 days seems completely sufficient to make sure that they are renewed before they expire. If you had said that a daily check is better because the plan is to significantly reduce the duration of letsencrypt certs, then I would understand, but like this?
[/quote]

This was an arbitrary decision to make sure that people would have a comfortable amount of time in which to respond to possible renewal failures, taking into account that people may be on holiday, may have taken over a job or responsibility from someone else, may require other people's help to complete the renewal process, etc. We often get people asking here about certificates that are only a short time away from expiry, which is unfortunate because it increases everyone's stress level unnecessarily. If the default renewal interval were higher, we would probably be getting even more questions from people who are in this situation.

You can change this interval with a setting called renew_before_expiry in /etc/letsencrypt/cli.ini if you think it's too long.

[tophee]

@schoen

Unfortunately, I believe certificates obtained with "manual" can't be renewed by certbot renew at all. This might not be true with hooks, but I'll have to double-check.

According to @jmorahan, it is possible:

@jmorahan

I think the easiest way to move a site to a different server is to first request a new certificate on the new server using certbot's --manual plugin. This allows you to validate the domain by manually creating a file on the site, which you can do on the old server while the DNS is still pointing at it, even though certbot itself is running on the new server. Then you can test using your hosts file and make sure everything is working properly before you make any changes to the DNS. Once you have everything migrated and the DNS pointed at the new server, remember to get a new certificate with --webroot or another plugin (or directly modify the configuration) so that renewals will work correctly.

@jmorahan

the fact that you used --manual will be remembered and it will try to do the same thing again when the cron job runs - but this will fail because you won't be around at the terminal to read and follow the instructions. So you need to update the renewal configuration, and the simplest way to do that is to request a new certificate using the proper plugin

[schoen]

In that example @jmorahan is apparently suggesting switching an existing certificate lineage away from manual to a different plugin, rather than renewing while it still using manual.