2

I've installed certbot on an Ubuntu 16.04 host using the PPA.

I can see that the certbot timer is configured to run and that it's running:

jaraco@punisher:~$ sudo systemctl status certbot
● certbot.service - Certbot
   Loaded: loaded (/lib/systemd/system/certbot.service; static; vendor preset: enabled)
   Active: inactive (dead) since Wed 2018-12-26 01:02:41 UTC; 15h ago
     Docs: file:///usr/share/doc/python-certbot-doc/html/index.html
           https://letsencrypt.readthedocs.io/en/latest/
  Process: 18502 ExecStart=/usr/bin/certbot -q renew (code=exited, status=0/SUCCESS)
 Main PID: 18502 (code=exited, status=0/SUCCESS)

Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable.
jaraco@punisher:~$ cat /lib/systemd/system/certbot.service
[Unit]
Description=Certbot
Documentation=file:///usr/share/doc/python-certbot-doc/html/index.html
Documentation=https://letsencrypt.readthedocs.io/en/latest/
[Service]
Type=oneshot
ExecStart=/usr/bin/certbot -q renew
PrivateTmp=true

Yet, today I noticed that one of the sites managed by certbot had an expired certificate (24 Dec).

I ran sudo certbot renew and the certificate renewed properly.

So what is wrong? Why would the timer run successfully but fail to renew an expiring (or expired) certificate when running the command manually works just fine?

Jason R. Coombs
  • 1,000
  • 1
  • 10
  • 18
  • At a guess, permissions. i.e. Cert was successfully renewed, but new cert couldn't be saved to disk. – 3D1T0R Dec 26 '18 at 21:03
  • If there were permissions issues, I'd have expected the exit code for the certbot process to be non-zero... and for there to be an error emitted in the logs. – Jason R. Coombs Dec 28 '18 at 21:46
  • 1
    Check the version of certbot with `certbot --version`, you can be using a older version with a bug. You should also check the user of the certbot service with a `ps` command. – NetVicious Jan 05 '22 at 07:49
  • I no longer have the relevant server, and in other environments, certbot is renewing as expected, so it was probably a bug that was fixed. – Jason R. Coombs Feb 07 '22 at 21:07

0 Answers0