Let’s Encrypt – How do I Cron?

Let’s Encrypt was really easy to setup, but Cron was less so. I kept getting emails that the Let’s Encrypt renewal was failing:

2017-03-09 02:51:02,285:WARNING:letsencrypt.cli:Attempting to renew cert from /etc/letsencrypt/renewal/bbbburns.com.conf produced an unexpected error: The apache plugin is not working; there may be problems with your existing configuration.
The error was: NoInstallationError(). Skipping.
1 renew failure(s), 0 parse failure(s)

I had a cron job setup with the absolute bare minimum:

crontab -e
56 02 * * * /usr/bin/letsencrypt renew >> /var/log/le-renew.log

When I ran

/usr/bin/letsencrypt renew

at the command line, everything worked just fine. I was like, “Oh – this must be some stupid cron thing that I used to know, but never remember.”

Turns out the problem was the cron environment PATH variable. Cron didn’t have access to /usr/sbin and apparently certbot was using that for access to the apache2 binary. The fix was to change the cron to the following:

56 02 * * * /root/le-renew.sh

Then create a script that runs the renewal after the PATH variable is set correctly:

cat /root/le-renew.sh
#!/bin/bash 
#Automate the LE renewal process

#Need /usr/sbin for apache2
# https://github.com/certbot/certbot/issues/1833
export PATH=$PATH:/usr/sbin

#Renew the certs and log the results
 /usr/bin/letsencrypt renew >> /var/log/le-renew.log

It was a good thing I put the link to the problem right in the script, or I never would have been able to find it again to write this blog.

NOW my renewal works absolutely fine. Problem solved. Thanks Cron.

Posted

2017-03-13

Uncategorized

Jason Burns

Tags:

hacking, Projects, Security

Comments

2 responses to “Let’s Encrypt – How do I Cron?”

Burns

2017-06-06

Apparently this problem is fixed in newer versions of the certbot, but my Ubuntu server version doesn’t package the version with the fix.

I’m not upgrading my server dist version any time soon, and not rolling a custom install of a package – so this workaround will have to stick around for a while.
Burns

2017-05-31

After this fix – things have been working well. I added some small tweaks to put the date into the log file that the cron job script makes. I also expanded the let’s encrypt config to cover all of my domains on that server.

I would still highly recommend Let’s Encrypt.