Renew Script with if and email

[wbargent]

This is currently my renew script which I run daily via crontab.

if $renewpath renew --dry-run >> $log/renew.log then echo "---------- LetsEncrypt Renew - Passed ---------- $now ----------" >> $log/renew.log else echo "---------- LetsEncrypt Renew - Failed ---------- $now ----------" >> $log/renew.log exit echo -e $(cat /LetsEncrypt-Scripts/email-templates/renewal-failed.template) | mail -s "$(echo -e "LetsEncrypt Renewal - Failed\nContent-Type: text/html")" -a "From: $emailfrom" $emailto fi

What it does it send an email if the renew fails; what I want it is to also send a email if a renewal happens but at the moment even if a certificate is skipped it passes. Is there a status code I could use and if so how could I implement it (or if anyone as a better suggestion on this, would appreciate it).

Thanks

[tialaramex]

Idea: Probably there isn’t a status code, but you could inspect the certificate with e.g. stat and if it’s new send email about that.

Another idea: Completely separate script, just looks at all your certificates and checks none have < 10 days left on them then emails “Hooray, all certificates are safe for another week”. If you don’t get the email, time to investigate. This is very fail safe, if there’s a bug in the script, or the disks fail or the mail server crashes or the power to the building goes off, you don’t get that mail, time to investigate. Whereas ensuring you’d always get a message saying “Something is wrong” is much harder to achieve.

[pfg]

There are a number of options. 0.5.0 introduced hooks which are called when certificates are renewed:

Client Version 0.5.0

The flags --pre-hook, --post-hook, and --renew-hook which can be usedwith the renew subcommand to register shell commands to run inresponse to renewal events. Pre-hook commands will be run beforeany certs are renewed, post-hook commands will be run after any certs are renewed, and renew-hook commands will be run after eachcert is renewed. If no certs are due for renewal, no command is run.

You could also inspect the output of of the renew run and use that to determine your action. For example:

OUT=$(/path/to/letsencrypt-auto renew)
if [ $? -eq 0 ]; then
	if grep -q "Congratulations!" <<<$OUT; then
		# certificates renewed successfully
	else
		# certificates not due for renewal
	fi
else
	# error during renewal
fi

[wbargent]

Not to worried about that problem as my server if running on AWS Ec2, pretty reliable when it comes to that.