No luck enabling certbot-renew.timer

pleo87508 · June 26, 2024, 3:59pm

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: orgibisph.net

I ran this command:
sudo systemctl enable --now certbot-renew.timer
and
sudo systemctl enable --now snap.certbot-renew.timer

It produced this output:
Failed to enable unit: Unit file certbot-renew.timer does not exist.
and
Failed to enable unit: Unit file snap.certbot-renew.timer does not exist.
My web server is (include version):
Apache 2.4.58-1ubuntu8.1 amd64

The operating system my web server runs on is (include version):
ubuntu 24.04
My hosting provider, if applicable, is:
AWS
I can login to a root shell on my machine (yes or no, or I don't know):
Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 2.11.0
certbot-auto: command not found

pleo87508 · June 26, 2024, 4:08pm

I recently installed certbot using snap. I believe that is what Letsencrypt.org docs suggested.
certbot is running and i have obtained to ssl certificates, thanks to the help of the group
I'm new to snap, and new to systemd timers. I've used cron for a very long time.
I'm trying to have certbot configured as close as possible to documentation.

A partial listing of /etc/systemd/system shows:

But running
sudo systemctl enable --now snap.certbot-renew.timer
or
sudo systemctl enable --now certbot-renew.timer

Am not sure what to do next.
Am I mssing a link for snap?
Are there different commands for snap?

MikeMcQ · June 26, 2024, 4:17pm

You usually don't have to do anything on systems (like Ubuntu) that have the timer installed with Certbot

What does this say

sudo systemctl --no-pager -l list-timers

From: User Guide — Certbot 2.12.0.dev0 documentation

pleo87508 · June 26, 2024, 5:22pm

Even if was done with snap? instead ubuntu native package manager?
Here's command results, and below it with

ubuntu@ip-10-0-0-102:~$ sudo systemctl --no-pager -l list-timers

NEXT                                 LEFT LAST                              PASSED UNIT                           ACTIVATES
Wed 2024-06-26 17:20:00 UTC           56s Wed 2024-06-26 17:10:39 UTC     8min ago sysstat-collect.timer          sysstat-collect.service
Wed 2024-06-26 18:58:12 UTC      1h 39min Wed 2024-06-26 17:17:39 UTC 1min 24s ago fwupd-refresh.timer            fwupd-refresh.service
Wed 2024-06-26 19:25:10 UTC       2h 6min Wed 2024-06-26 00:17:28 UTC      17h ago motd-news.timer                motd-news.service
Wed 2024-06-26 20:11:00 UTC      2h 51min Wed 2024-06-26 08:45:39 UTC       8h ago snap.certbot.renew.timer       snap.certbot.renew.service
Thu 2024-06-27 00:00:00 UTC            6h Wed 2024-06-26 00:00:01 UTC      17h ago dpkg-db-backup.timer           dpkg-db-backup.service
Thu 2024-06-27 00:00:00 UTC            6h Wed 2024-06-26 00:00:01 UTC      17h ago logrotate.timer                logrotate.service
Thu 2024-06-27 00:07:00 UTC            6h Wed 2024-06-26 00:07:23 UTC      17h ago sysstat-summary.timer          sysstat-summary.service
Thu 2024-06-27 03:23:23 UTC           10h Wed 2024-06-26 08:13:39 UTC       9h ago apt-daily.timer                apt-daily.service
Thu 2024-06-27 06:14:03 UTC           12h Wed 2024-06-26 06:05:39 UTC      11h ago apt-daily-upgrade.timer        apt-daily-upgrade.service
Thu 2024-06-27 09:19:05 UTC           16h Wed 2024-06-26 07:05:52 UTC      10h ago man-db.timer                   man-db.service
Thu 2024-06-27 13:00:01 UTC           19h Wed 2024-06-26 13:00:01 UTC 4h 19min ago update-notifier-download.timer update-notifier-download.service
Thu 2024-06-27 13:10:01 UTC           19h Wed 2024-06-26 13:10:01 UTC  4h 9min ago systemd-tmpfiles-clean.timer   systemd-tmpfiles-clean.service
Sun 2024-06-30 03:10:34 UTC        3 days Sun 2024-06-23 03:10:58 UTC            - e2scrub_all.timer              e2scrub_all.service
Mon 2024-07-01 00:11:04 UTC        4 days Mon 2024-06-24 01:22:39 UTC   2 days ago fstrim.timer                   fstrim.service
Thu 2024-07-04 08:18:19 UTC 1 week 0 days Sun 2024-06-23 12:29:27 UTC            - update-notifier-motd.timer     update-notifier-motd.service

Same command with --all added:Pass --all to see loaded but inactive timers, too.
ubuntu@ip-10-0-0-102:~$ sudo systemctl --no-pager -l --all list-timers

NEXT                                 LEFT LAST                              PASSED UNIT                           ACTIVATES
Wed 2024-06-26 17:30:00 UTC          8min Wed 2024-06-26 17:20:39 UTC      43s ago sysstat-collect.timer          sysstat-collect.service
Wed 2024-06-26 18:58:12 UTC      1h 36min Wed 2024-06-26 17:17:39 UTC 3min 43s ago fwupd-refresh.timer            fwupd-refresh.service
Wed 2024-06-26 19:25:10 UTC       2h 3min Wed 2024-06-26 00:17:28 UTC      17h ago motd-news.timer                motd-news.service
Wed 2024-06-26 20:11:00 UTC      2h 49min Wed 2024-06-26 08:45:39 UTC       8h ago snap.certbot.renew.timer       snap.certbot.renew.service
Thu 2024-06-27 00:00:00 UTC            6h Wed 2024-06-26 00:00:01 UTC      17h ago dpkg-db-backup.timer           dpkg-db-backup.service
Thu 2024-06-27 00:00:00 UTC            6h Wed 2024-06-26 00:00:01 UTC      17h ago logrotate.timer                logrotate.service
Thu 2024-06-27 00:07:00 UTC            6h Wed 2024-06-26 00:07:23 UTC      17h ago sysstat-summary.timer          sysstat-summary.service
Thu 2024-06-27 03:23:23 UTC           10h Wed 2024-06-26 08:13:39 UTC       9h ago apt-daily.timer                apt-daily.service
Thu 2024-06-27 06:14:03 UTC           12h Wed 2024-06-26 06:05:39 UTC      11h ago apt-daily-upgrade.timer        apt-daily-upgrade.service
Thu 2024-06-27 09:19:05 UTC           15h Wed 2024-06-26 07:05:52 UTC      10h ago man-db.timer                   man-db.service
Thu 2024-06-27 13:00:01 UTC           19h Wed 2024-06-26 13:00:01 UTC 4h 21min ago update-notifier-download.timer update-notifier-download.service
Thu 2024-06-27 13:10:01 UTC           19h Wed 2024-06-26 13:10:01 UTC 4h 11min ago systemd-tmpfiles-clean.timer   systemd-tmpfiles-clean.service
Sun 2024-06-30 03:10:34 UTC        3 days Sun 2024-06-23 03:10:58 UTC            - e2scrub_all.timer              e2scrub_all.service
Mon 2024-07-01 00:11:04 UTC        4 days Mon 2024-06-24 01:22:39 UTC   2 days ago fstrim.timer                   fstrim.service
Thu 2024-07-04 08:18:19 UTC 1 week 0 days Sun 2024-06-23 12:29:27 UTC            - update-notifier-motd.timer     update-notifier-motd.service
-                                       - -                                      - apport-autoreport.timer        apport-autoreport.service
-                                       - -                                      - certbot.timer                  -
-                                       - -                                      - snapd.snap-repair.timer        snapd.snap-repair.service
-                                       - -                                      - ua-timer.timer                 ua-timer.service

pleo87508 · June 26, 2024, 5:23pm

And then:
sudo systemctl enable certbot.timer
Failed to enable unit: Unit file certbot.timer does not exist.

Osiris · June 26, 2024, 5:32pm

I'm not a snap expert, but I thought the generic snap timer would also trigger the Certbot renew snap timer thingy.

You can check the Certbot log for regular updates (i.e., twice a day).

pleo87508 · June 26, 2024, 5:44pm

Will try and find the certbot log, and also try and do more research on snap.
Does Letsencrypt suggest using snap certbot or native linux certbot

If it's native linux, is there a way to back out of snap certbot and run with linux certbot?

Would I delete/revoke certs via snap certbot, and then start over with linux certbot?

MikeMcQ · June 26, 2024, 6:01pm

Let's Encrypt is managed by the ISRG. Certbot by EFF.

And, yes, EFF recommend using the snap install when possible. Ubuntu and snap are both developed by Canonical so they work well together.

https://eff-certbot.readthedocs.io/en/latest/install.html#snap-recommended

pleo87508 · June 26, 2024, 6:04pm

A few more interesting items. I have found 2 versions of certbot. Am a little embarrased, but oh well.
/usr/bin/certbot --version
certbot 2.11.0

/snap/certbot/current/bin/certbot --version
certbot 2.9.0

I think I need to find which one I am using.
Given that the systemd timers are not enabled, I can just add a crontentry and specify the /usr/bin/certbot

MikeMcQ · June 26, 2024, 6:05pm

Please review the install docs found here

pleo87508 · June 26, 2024, 6:09pm

Will do. Thanks. I have to decide which certbot I want to use. It may be better to just stick with unbuntu OS version, it is later.
I think what I missed was/is the symlink to snap, so I think I'm basically using the ubuntu certtot. Will read more about it

MikeMcQ · June 26, 2024, 6:16pm

No, the snap version updates itself automatically.

You asked which was recommended and now you ignore that recommendation. I mean, why did you ask then?

Please follow the install instructions closely. Many people make that same mistake

Osiris · June 26, 2024, 6:23pm

Weird. Snaps should automatically update to the latest version, in Certbots case currently 2.11.0. And /usr/bin/certbot should be a symbolic link to /snap/certbot/somwehere/something. So it's kinda weird to see the Certbot directly invoked from snap be older than the one from /usr/bin/certbot

As said, snaps should always be the most recent versions. Packaged versions are often notoriously old, especially on Debian. I do not recommend using OS packages, unless you're running Gentoo or a similar distribution with good and up to date repositories.

pleo87508 · June 26, 2024, 6:32pm

Sorry all, didn't mean to ignore. It's just am less familiar with snap.
Also I stand corrected, the snap version is the latest version.
The OS version is the older version.
So I'm back to using the latest snap version.
I need to research more about systemd timers
As I do that I have added a crontab entry for now.
Sorry for all of the confusion

MikeMcQ · June 26, 2024, 6:51pm

I think your timer is just fine. And, if it is just know that if that and your crontab run at the same time Certbot will issue an error. Only one instance of Certbot can run at a time.

That is probably unlikely but if you see errors about "lock file" or similar that may be why

pleo87508 · June 26, 2024, 7:14pm

Great, thanks for your help -- AGAIN

MikeMcQ · June 26, 2024, 8:01pm

Based on your earlier list-timers command a certbot renew should start soon

NEXT                                 LEFT LAST                              PASSED UNIT                           ACTIVATES
...
Wed 2024-06-26 20:11:00 UTC      2h 51min Wed 2024-06-26 08:45:39 UTC       8h ago snap.certbot.renew.timer       snap.certbot.renew.service
...

The NEXT time is 20:11 UTC so in 10 minutes from now

To confirm it ran Certbot, see the /var/log/letsencrypt folder for a log matching that time

system · July 26, 2024, 8:01pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Automatice renew not working, certbot.renew.timer missing Help	5	1937	January 30, 2023
Cron Timer, Renewal, adjust trigger? Help	2	951	February 15, 2020
Having issues installing certbot certificates Help	16	95	August 31, 2024
Unable to renew Help	8	1031	March 14, 2021
When to run certbot renew? Once a day is not enough? Help	4	1685	April 11, 2019

No luck enabling certbot-renew.timer

Related topics