<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><h2 data-reader-unique-id="60" style="font-size: 1.2777em; max-width: 100%; caret-color: rgb(79, 50, 28); color: rgb(79, 50, 28); font-family: -apple-system-font;">Automatic renewal</h2><p data-reader-unique-id="61" style="max-width: 100%; caret-color: rgb(79, 50, 28); color: rgb(79, 50, 28); font-family: -apple-system-font;">The Ubuntu package for certbot comes pre-configured with <a href="https://www.freedesktop.org/software/systemd/man/systemd.timer.html" data-reader-unique-id="62" style="text-decoration: none; color: rgb(209, 150, 0); max-width: 100%;">systemd timer</a> that will automatically renew existing certificates. What it does not handle however is reloading postfix/dovecot so that they will begin using the new certificates. For that, we need to implement a hook.</p><p data-reader-unique-id="63" style="max-width: 100%; caret-color: rgb(79, 50, 28); color: rgb(79, 50, 28); font-family: -apple-system-font;">Certbot has both pre and post hooks that you can use to execute a script prior to and after the renewal process. It also has a renew hook that is run whenever a certificate is successfully renewed.</p><p data-reader-unique-id="64" style="max-width: 100%; caret-color: rgb(79, 50, 28); color: rgb(79, 50, 28); font-family: -apple-system-font;">Both the renew hook and post hook are good candidates for our reload script. Each has a downside however. The post hook will be run after every renewal attempt, regardless of if anything was actually renewed or not. This will result in the services being reloaded many times for no reason.</p><p data-reader-unique-id="65" style="max-width: 100%; caret-color: rgb(79, 50, 28); color: rgb(79, 50, 28); font-family: -apple-system-font;">The renew hook only runs if a certificate was successfully renewed, but it will be run once for each certificate. This could mean reloading services multiple times if you have multiple certificates. If you only have a single certificate however it'll work great.</p><p data-reader-unique-id="66" style="max-width: 100%; caret-color: rgb(79, 50, 28); color: rgb(79, 50, 28); font-family: -apple-system-font;">In my case I only have a single certificate, so the renew hook is what I'm going to use. To setup the hooks a <a href="https://certbot.eff.org/docs/using.html#configuration-file" data-reader-unique-id="67" style="text-decoration: none; color: rgb(209, 150, 0); max-width: 100%;">configuration file for certbot</a> needs to be created at <code data-reader-unique-id="68" style="max-width: 100%;">/etc/letsencrypt/cli.ini</code>. The configuration file consists of simple name=value pairs where the name is taken from the <a href="https://certbot.eff.org/docs/using.html#certbot-command-line-options" data-reader-unique-id="69" style="text-decoration: none; color: rgb(209, 150, 0); max-width: 100%;">list of command line parameters</a>.</p><p data-reader-unique-id="70" style="max-width: 100%; caret-color: rgb(79, 50, 28); color: rgb(79, 50, 28); font-family: -apple-system-font;">To configure a renew hook, add the following to the configuration file:</p><div class="scrollable" style="-webkit-overflow-scrolling: touch; max-width: 100%; overflow-x: scroll; word-wrap: normal; caret-color: rgb(79, 50, 28); color: rgb(79, 50, 28); font-family: -apple-system-font;"><pre data-reader-unique-id="71" style="font-family: -apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: 1.45em; max-width: 100%; white-space: pre;"><code data-reader-unique-id="72" style="max-width: 100%;"><span data-reader-unique-id="73" style="max-width: 100%;">renew-hook</span> = /root/bin/certbot-renew
</code></pre></div><p data-reader-unique-id="74" style="max-width: 100%; caret-color: rgb(79, 50, 28); color: rgb(79, 50, 28); font-family: -apple-system-font;">Next, create the renew hook script at <code data-reader-unique-id="75" style="max-width: 100%;">/root/bin/certbot-renew</code> with the following contents:</p><div class="scrollable" style="-webkit-overflow-scrolling: touch; max-width: 100%; overflow-x: scroll; word-wrap: normal; caret-color: rgb(79, 50, 28); color: rgb(79, 50, 28); font-family: -apple-system-font;"><pre data-reader-unique-id="76" style="font-family: -apple-system-ui-monospaced, Menlo; font-size: 0.87em; line-height: 1.45em; max-width: 100%; white-space: pre;"><code data-reader-unique-id="77" style="max-width: 100%;"><span data-reader-unique-id="78" style="max-width: 100%;">#!/bin/sh</span>
systemctl reload postfix
systemctl reload dovecot</code></pre></div><br><div dir="ltr">Sent from my iPhone</div><div dir="ltr"><br><blockquote type="cite">On Oct 9, 2020, at 04:17, Rogier Wolff <R.E.Wolff@bitwizard.nl> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><span>Hi, </span><br><span></span><br><span>I get my Email from my own SMTP server on the internet using</span><br><span>"fetchmail". Some time ago I did the smart thing and configured</span><br><span>dovecot to use SSL and the letsencrypt certificate that automatically</span><br><span>renews.</span><br><span></span><br><span>Welllll..... a few days ago my certificate expired and the fetchmail</span><br><span>deamon running in the background had nowhere to complain. So I didn't</span><br><span>notice. </span><br><span></span><br><span>It turns out that dovecot had been running uninterrupted since august</span><br><span>13th, the certificate was renewed on september 7th and I suspect it</span><br><span>expired on october 7th.</span><br><span></span><br><span>So.... Feature request: check the expiry date on the SSL certificate</span><br><span>as it is being loaded and check for a new certificate if it HAS</span><br><span>expired.</span><br><span></span><br><span>If you worry about performance, this could be done where: </span><br><span></span><br><span>TLS handshaking: SSL_accept() failed: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired: SSL alert number 45</span><br><span></span><br><span>is reported. That would mean that ONE client will once get the error</span><br><span>before dovecot fixes it. My personal fix is to restart dovecot once a</span><br><span>week from now on.</span><br><span></span><br><span>I might be running an older version: </span><br><span></span><br><span># 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf</span><br><span># Pigeonhole version 0.4.21 (92477967)</span><br><span># OS: Linux 4.15.0-34-generic x86_64 Ubuntu 18.04.5 LTS </span><br><span></span><br><span>if it has already been fixed, please accept my apologies.</span><br><span></span><br><span> Roger. </span><br><span></span><br><span>-- </span><br><span>** R.E.Wolff@BitWizard.nl ** https://www.BitWizard.nl/ ** +31-15-2049110 **</span><br><span>** Delftechpark 11 2628 XJ Delft, The Netherlands. KVK: 27239233 **</span><br><span>f equals m times a. When your f is steady, and your m is going down</span><br><span>your a is going up. -- Chris Hadfield about flying up the space shuttle.</span><br></div></blockquote></body></html>