Feature request.

[David Morsberger]

Automatic renewal

The Ubuntu package for certbot comes pre-configured with systemd timer that will automatically renew existing certificates. What it does not handle however is reloading postfix/dovecot so that they will begin using the new certificates. For that, we need to implement a hook.

Certbot has both pre and post hooks that you can use to execute a script prior to and after the renewal process. It also has a renew hook that is run whenever a certificate is successfully renewed.

Both the renew hook and post hook are good candidates for our reload script. Each has a downside however. The post hook will be run after every renewal attempt, regardless of if anything was actually renewed or not. This will result in the services being reloaded many times for no reason.

The renew hook only runs if a certificate was successfully renewed, but it will be run once for each certificate. This could mean reloading services multiple times if you have multiple certificates. If you only have a single certificate however it'll work great.

In my case I only have a single certificate, so the renew hook is what I'm going to use. To setup the hooks a configuration file for certbot needs to be created at /etc/letsencrypt/cli.ini. The configuration file consists of simple name=value pairs where the name is taken from the list of command line parameters.

To configure a renew hook, add the following to the configuration file:

renew-hook = /root/bin/certbot-renew
Next, create the renew hook script at /root/bin/certbot-renew with the following contents:

#!/bin/sh
systemctl reload postfix
systemctl reload dovecot

Sent from my iPhone

> On Oct 9, 2020, at 04:17, Rogier Wolff <R.E.Wolff at bitwizard.nl> wrote:
> 
> Hi, 
> 
> I get my Email from my own SMTP server on the internet using
> "fetchmail". Some time ago I did the smart thing and configured
> dovecot to use SSL and the letsencrypt certificate that automatically
> renews.
> 
> Welllll..... a few days ago my certificate expired and the fetchmail
> deamon running in the background had nowhere to complain. So I didn't
> notice. 
> 
> It turns out that dovecot had been running uninterrupted since august
> 13th, the certificate was renewed on september 7th and I suspect it
> expired on october 7th.
> 
> So.... Feature request: check the expiry date on the SSL certificate
> as it is being loaded and check for a new certificate if it HAS
> expired.
> 
> If you worry about performance, this could be done where: 
> 
> TLS handshaking: SSL_accept() failed: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired: SSL alert number 45
> 
> is reported. That would mean that ONE client will once get the error
> before dovecot fixes it. My personal fix is to restart dovecot once a
> week from now on.
> 
> I might be running an older version: 
> 
> # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf
> # Pigeonhole version 0.4.21 (92477967)
> # OS: Linux 4.15.0-34-generic x86_64 Ubuntu 18.04.5 LTS 
> 
> if it has already been fixed, please accept my apologies.
> 
>    Roger. 
> 
> -- 
> ** R.E.Wolff at BitWizard.nl ** https://www.BitWizard.nl/ ** +31-15-2049110 **
> **    Delftechpark 11 2628 XJ  Delft, The Netherlands.  KVK: 27239233    **
> f equals m times a. When your f is steady, and your m is going down
> your a is going up.  -- Chris Hadfield about flying up the space shuttle.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://dovecot.org/pipermail/dovecot/attachments/20201009/01a7d2a1/attachment.html>