Can't install new certificates with certbot-apache under Gentoo since version 0.20.0

[Tito1337]

It seems that version 0.20.0 has a major architecture revision from 0.19.0, in particular regarding OS specific overrides. But the Gentoo overrides have a flaw when trying to install a new certificate : at one point it tries to run "apache2ctl -t -D DUMP_MODULES", which is no good at all under Gentoo because apache2ctl is a dummy script redirecting to /etc/init.d/apache2. It generates this error :

Error in checking parameter list: /etc/init.d/apache2: invalid option -- 't'

My operating system is (include version):

Gentoo

I installed Certbot with (certbot-auto, OS package manager, pip, etc):

OS package manager (emerge) with testing (~amd64) flag

I ran this command and it produced this output:

certbot -d test.example.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for test.example.com
Waiting for verification...
Cleaning up challenges
Error in checking parameter list: /etc/init.d/apache2: invalid option -- 't'

Apache is unable to check whether or not the module is loaded because Apache is misconfigured.

Certbot's behavior differed from what I expected because:

Certbot did not install the certificate because it failed to run apache2ctl -t -D DUMP_MODULES

[Tito1337]

Pinging @joohoi because this is related to your pull request #5202

[Tito1337]

Solution is probably to override the reset_modules in the same way that you override update_runtime_variables, because everything goes well until cleanup when reset_modules is called

Sorry I don't have enough know-how to patch it myself

[joohoi]

Thanks for the detailed bug report, you are completely right about the fix too! While I was working on the PR, I actually patched that functionality for Gentoo ( https://bugs.gentoo.org/634414 ) , and looks like I left the patched version of apache2ctl in my test system and this go through.
I'm going to fix this asap, sorry for the inconvinience.

[igravious]

@joohoi This bug bit me :(

What do I do in the meantime to renew my certs?

[Tito1337]

@igravious I suggest downgrading to version 0.19.0

[joohoi]

Unfortunately the only options seem to be downgrading, or temporarily substituting the apache2ctl script with one I patched and submitted upstream (see the Gentoo bug linked in my earlier comment): The patched apache2ctl: https://634414.bugs.gentoo.org/attachment.cgi?id=498822

[Polynomial-C]

FYI, this has been fixed in Gentoo with apache-2.4.33 meanwhile.