25

I'm automating an SSL certificate renewal from LetsEncrypt's certbot. The actual renewal is working, but I need to automate restarting services so that they load the renewed certificates. I was wondering if you can use multiple --renew-hook parameters within the cronjob for letsencrypt renew?

How to automate restarting services upon certificate renewal?

7 Answers 7

42

Not sure if that's for newer versions only or not, but hope someone will find it useful. When you have at least 1 domain added, certbot will create "renewal-hooks" dir with 3 subdirs "deploy", "post", "pre".

If you will put any script into "post" folder, that will be executed after renewal automatically. Don't forget to make it executable by adding +x to the script.

I'm using just one "001-restart-nginx.sh" with the following content:

#!/bin/bash
echo "ssl certs updated" && service nginx restart

/etc/letsencrypt/renewal-hooks/post/001-restart-nginx.sh

This way you don't have to manually supply --post-hook params with certain instructions at all.

On actual renewal process you will see something like this:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all renewals succeeded. The following certs have been renewed:
  /etc/letsencrypt/live/<your-domain-name>/fullchain.pem (success)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Running post-hook command: /etc/letsencrypt/renewal-hooks/post/001-restart-nginx.sh
Output from post-hook command 001-restart-nginx.sh:
ssl certs updated
1
  • 5
    It's better to use nginx reload as restart will lead to unnecessary downtime.
    – Mazzy
    Commented Jul 29, 2022 at 9:28
22

Yes you can use multiple --renew-hook statements. also use the -q flag so it emails you a blank notification until a renewal actually does occur. It also does not restart any of your services until a renewal occurs. This also attaches the log file to the email if you so desire.

I have a cron that runs a bash daily.

Inside my bash (certbotrenew.sh) is simply this

#!/bin/bash
cd /opt/certbot
sudo ./certbot-auto renew --renew-hook "service postfix reload" --renew-hook "service dovecot restart" --renew-hook "service apache2 reload" -q >> /var/log/certbot-renew.log | mail -s "CERTBOT Renewals" [email protected]  < /var/log/certbot-renew.log
exit 0

and my cron is

00 20 * * 1 /bin/certbotrenew.sh

Some people question why I send an email regardless of if nothing happened, I just always like to know my daily crons are running.

7
  • 1
    It looks like the default package manager for Ubuntu 16.04 carries an old version of Certbot that doesn't accept --renew-hook arguments.
    – bkoodaa
    Commented Feb 24, 2017 at 14:24
  • 1
    Yes the repo has a very old version of Let's Encrypt, which has been renamed to certbot anyway last year. You can simply uninstall the repo version and then simply mkdir /opt/certbot and then cd /opt/certbot and then sudo wget https://dl.eff.org/certbot-auto then just run your certbot-auto command lines from there. If memory serves me correct the version in the Ubuntu repo is v0.4 of let's encrypt. Certbot is now at 0.11.
    – MitchellK
    Commented Feb 28, 2017 at 9:46
  • 2
    @MitchellK - rather than getting a daily cron email, how about a cron reporting service like IsItWorking.info (mine). Your cron script can check in each time it runs successfully. If it doesn't check in, then the service alerts you. (Possibly in addition to an email) Commented Mar 31, 2017 at 9:11
  • 1
    @W.M. Yes, that is correct. When you run it on the command line without the --force-renew option, you will see No renewals were attempted. No hooks were run. at the end of the output
    – Speeddymon
    Commented May 6, 2018 at 1:52
  • 1
    Note: On newer (early 2023) versions, you cannot use multiple --pre-hook (or others hooks). Each new directive of the same name will overwrite the previous one. But you can put the directive once, and then list multiple scripts, space-separated and encapsulated by double-quotes. Example: --pre-hook "script1 script2 script3"
    – Moonchild
    Commented Jan 2, 2023 at 10:55
14

You can also set hooks (and others options if you like) as global options in the file /etc/letsencrypt/cli.ini (see documentation) like this:

# Global config for letsencrypt runs
#
# Note that these options apply automatically to all use of Certbot for
# obtaining or renewing certificates, so options specific to a single
# certificate on a system with several certificates should not be placed
# here.

renew-hook = service postfix reload
post-hook = service nginx reload

You must create the file first on most systems. Letsencrypt comes without.

You can also create certificate specific version in every renewal folder if you don't like to go global.

1
  • Yes that works, but the --renew-hook suggestion in the other answer is preferred. When you run the command with --renew-hook, that makes it add the hook info to the domain in /etc/letsencrypt/renewal, so the hook will get run each time automatically. That's a preferred solution rather than editing /etc/letsencrypt/cli.ini directly.
    – orrd
    Commented Feb 1, 2020 at 3:13
7

From what I saw from the fresh installation in Ubuntu 16.04 of CertBot, it creates a cron job:

# /etc/cron.d/certbot: crontab entries for the certbot package
#
# Upstream recommends attempting renewal twice a day
#
# Eventually, this will be an opportunity to validate certificates haven't been revoked, etc.  Renewal will only occur if expiration is within
# 30 days.
SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew --pre-hook 
'/bin/run-parts /etc/letsencrypt/pre-hook.d/' --post-hook '/bin/run-parts /etc/letsencrypt/post-hook.d/' --renew-hook '/bin/run-parts
/etc/letsencrypt/renew-hook.d/'

So it executes run-parts on many directories, including /etc/letsencrypt/renew-hook.d/

You just need to add an executable file in any of those hook directories (pick the one you need).

As an example, in my renew-hook.d I created a file restart-nginx with the following content:

#!/bin/bash
/etc/init.d/nginx restart

As a note: You can know what files will be called by run-parts using the --test option. (Example run-parts --test /etc/letsencrypt/renew-hook.d/

2
  • 4
    They actually changed the certbot cronjob to no longer include those run-parts parameters anymore. Recommended way to accomplish the same now is to create a /etc/letsencrypt/cli.ini and specify the hook parameters in there, see github.com/certbot/certbot/issues/1706#issuecomment-302774426
    – Drew
    Commented May 19, 2017 at 18:56
  • 1
    Yes, either in a cli.ini, or the in [renewalparams] area in each /etc/letsencrypt/renewal/*.conf file if you don't want global. I have a mix of route53 and standalone, so I prefer to edit each renewal config file. You do not need a cli.ini in each renew area. Just edit the renew file.
    – B. Shea
    Commented Jan 25, 2021 at 18:57
5

The latest recommended method for running hook scripts is from /etc/letsencrypt/cli.ini. If the file is not present you can create it yourself. Another thing is that you should use --deploy-hook instead --renew-hook. --renew-hook is still present but will be getting phased out since it's not even mentioned in the latest documentation.

So just create /etc/letsencrypt/cli.ini if it doesn't exist and add the following line:

deploy-hook = "service postfix reload ; service dovecot restart ; service apache2 reload"

to reload those particular services.

1
  • Or, in [renewalparams] area in each /etc/letsencrypt/renewal/*.conf file if you don't want global ini.
    – B. Shea
    Commented Jan 25, 2021 at 18:58
1

There is also a place that controls certbot running (on ubuntu 16.04 + nginx — settings files bellow)

1) systemd timer

run commnad: sudo systemctl list-timers

and see output:

Sun 2018-07-08 00:46:59 EEST 7h left Sat 2018-07-07 12:36:26 EEST 4h 51min ago certbot.timer certbot.service

then

2)

check file that controls time when systemctl run Certbot

/etc/systemd/system/timers.target.wants/certbot.timer

this is the symbolic link for

/lib/systemd/system/certbot.timer

Pay attention to this lines that defines times + random seconds (set a random time for purpose not to stress letsencrypt servers)

OnCalendar=--* 00,12:00:00

RandomizedDelaySec=3600
1

For CentOS and Amazon Linux (and probably other types of Linux):

When you install certbot via yum, yum creates two services which keep your certificates up to date:

# systemctl list-unit-files | grep cert
certbot-renew.service                         static
certbot-renew.timer                           enabled

Once you enable the timer service, it runs periodically, invoking the renew service as needed.

The package installer also creates the template file /etc/sysconfig/certbot (below). This file is executed when the above certbot-renew service runs. It contains a stanza designed to run once for each successfully renewed certificate. This is the cleanest way I know of to tell your web server to acquire certificates, as the HOOK command does not run unnecessarily. For my Apache installation, I configure this stanza as follows:

# Command to be run in a shell once for each
# successfully renewed certificate. For this command,
# the shell variable $RENEWED_LINEAGE will point to the
# config live subdirectory containing the new certs and
# keys; the shell variable $RENEWED_DOMAINS will contain
# a space-delimited list of renewed cert domains
#
# An example to run a script to alert each cert would be:
# DEPLOY_HOOK="--deploy-hook /usr/local/bin/cert-notifier.sh"
DEPLOY_HOOK="--deploy-hook 'systemctl reload httpd'"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.