Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Renewal of letsencrypt certs creates new directory in /live/ #3

Closed
nerdoc opened this issue Apr 21, 2016 · 3 comments
Closed

Renewal of letsencrypt certs creates new directory in /live/ #3

nerdoc opened this issue Apr 21, 2016 · 3 comments

Comments

@nerdoc
Copy link
Owner

nerdoc commented Apr 21, 2016

when renewing the domain certificates, a new directory is created in ./config/letsencrypt/ named -0001 (and further: -0002 etc) instead of reusing the old certificate. This way renewals do not work really.
There seems to be a related bug in letsencrypt: certbot/certbot#2328 - but I don't know how to workaround this yet.
Any help welcome.

@nerdoc
Copy link
Owner Author

nerdoc commented Apr 24, 2016

The real issue seems to be certbot/certbot#2071.
I added a few workaround code lines to prevent adding the old certificate again to the uberspace server config when a new one was created in a 0001 directory. But this does not seem to play nicely - I still have to check.

@nerdoc
Copy link
Owner Author

nerdoc commented Aug 16, 2016

Another option (just to remember it) would be, like @dwt commented: delete ~/.config/letsencrypt/{archive,live,renewal} directories in case of renewing the cert (if another directory would be created), and do the process again.
We will get more mails then from Let's Encrypt, but that is better than having a non-working cert.

@nerdoc
Copy link
Owner Author

nerdoc commented Oct 12, 2017

I now created a new algorithm to check the current online cert, and compare it with the old certificate in the path, using sha256 fingerprints. If they match (meaning, the website is using the original path without the -0001 etc.), the update begins, else the script stops.
If in meantime a domain was deleted, and a -0001 folder is created, the letsencrypt-renew script does not find the certificate and complains too. But this is intended - you should interfere manually.
The script only updates the certs if there was no domain change.

@nerdoc nerdoc closed this as completed Oct 12, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant