Certificate renewal timeout overlap

strarsis · August 20, 2018, 4:27pm

Today, visiting one domain resulted in Chrome warning about an expired certificate (NET::ERR_CERT_DATE_INVALID) (expires 20.08.2018 (which is (still) today) according to the certificate details). I ran the cron manually to renew the cert.
Is the cron not executed often enough, is there a potential overlap for timed out certificates and the next cron run? Certificate expiration is 20.08.2018, which is also today. Maybe the few hours are rounded or some other offset issue?

ben · August 20, 2018, 5:04pm

It should never expire…

github.com

roots/trellis/blob/30ae7fe95370b24b955f971f90b3c8fe99d6473f/roles/letsencrypt/defaults/main.yml#L44




letsencrypt_keys_dir: "{{ nginx_ssl_path }}/letsencrypt"
letsencrypt_certs_dir: "{{ nginx_ssl_path }}/letsencrypt"


# the minimum age (in days) after which a certificate will be renewed
letsencrypt_min_renewal_age: 60


# the days of a month the cronjob should be run. Make sure to run it rather often, three times per month is a pretty
# good value. It does not harm to run it often, as it will only regenerate certificates that have passed a certain age
# (60 days by default).
letsencrypt_cronjob_daysofmonth: 1,11,21

strarsis · August 20, 2018, 5:06pm

So it may be the case that the cronjob hadn’t run correctly.
How can I find out what went wrong? Executing the command manually works.

ben · August 20, 2018, 7:49pm

strarsis · August 21, 2018, 7:24pm

Uh oh, I am not able to find recent invocations of the renew-certs.py script.

damodog · October 1, 2019, 12:24pm

Hi Ben.
So the certificate will only renew when the existing one is expired and the cron job only runs on those specific days. Are we supposed to amend the days the cron job is run to coincide with when the certificate will expire?

As an example, this morning we just had to manually renew our certificate on a project that isn’t officially live (we’ve switched on the Production droplet from time to time during dev) and recently noticed it had expired.
So this new certificate will last for 60 days and should expire the morning of 30th Nov. But the cron job won’t run until 1st to recognise this and renew it. So there will be a period of time with no valid certificate? Is this correct?

Sorry if I’m misunderstanding something.
Thanks,
Damian

damodog · October 14, 2019, 11:25am

Hi @ben,
Any chance you could confirm my thoughts on this?

swalkinshaw · October 15, 2019, 1:40am

Certificates last for 90 days. The cron job runs on the 1st, 11th, and 21st… there’s no way it will expire (unless it doesn’t work).