Cron Job - Lets Encrypt

[FN-GM]

Hello,

 

 

I have a cron job that runs the following to automatically renew Lets Encrypt certificates The command is:

 

30 2 * * * /opt/letsencrypt/letsencrypt-auto renew >> /var/log/le-renew.log

 

However it fails and puts this in the log:

 

-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/homepage.site.co.uk.conf
-------------------------------------------------------------------------------

All renewal attempts failed. The following certs could not be renewed:
 /etc/letsencrypt/live/homepage.site.co.uk/fullchain.pem (failure)

 

However if I run this command in manually in the CLI (even without Sudo) it runs without error

/opt/letsencrypt/letsencrypt-auto renew

 

Any thoughts please?

 

Thanks

[FN-GM]

Anyone please? I have a certificate that is due for renewal

 

@Geoff maybe?

[jinnantonnixx]

If you're running it from /etc/crontab or /etc/cron.d, you can specify a username to run your code. Try it as a username, rather than root.

 

e.g.

 

30 2 * * * some_username /opt/letsencrypt/letsencrypt-auto renew >> /var/log/le-renew.log

[Arcath]

I have exactly the same issue.

 

Posted about it on the lets encrypt forums. https://community.letsencrypt.org/t/crontab-renew-fails/20600/3

 

Got pointed to this: https://community.letsencrypt.org/t/letsencrypt-renew-not-working-with-cronjob-manually-it-works/16738/8

 

Which says you need to create a shell script to run renew that exports a path first. Crontab doesn't seem to use the users $PATH.

[Geoff]

Yes, cron doesn't have a full environment or tty setup when you run things via it. Happily this is easily solved. You need to use sudo to get a full environment. Additionally /bin/sh and /bin/bash are sometimes not the same thing. So to fix both issues here's a generic example:

 

* * * * * sudo -u user -i bash -c '. $HOME/.bash_profile; . $HOME/.bashrc; /home/user/myscript.sh;'

Edited October 5, 2016 by Geoff

[FN-GM]

Thanks.

 

What do I put in the .sh file please? Just the command to do the auto renew?

 

Thanks

[Geoff]

Yes, whatever it is you are trying to do. Alternatively if it's just a single command you can put it on the command line for sudo

[FN-GM]

I wasn't paying attention and accidentally renewed it by using the command manually!!! Will have to leave it a bit to try again now.

[k-strider]

did you fix this in the end?

[pete]

^ Try something like this in /etc/cron.daily/letsencryptrenewal*

 

#!/bin/sh
#Set the proxy variables
export http_proxy=http://server:port
export https_proxy=http://server:port

# Check the cert and renew if applicable
/opt/letsencrypt/certbot-auto renew

 

Then check the logfiles in /var/log/letsencrypt/ after a day or so.

 

*or whatever you want to call it.