Renewing Certbot Let's Encrypt WILDCARD Certificates in Cron

Question

I've been searching for a good solution to renew WILDCARD certificates from Let's Encrypt.

It's easy to set up a wildcard certificate:

Apache Debian 9 Stretch:

sudo apt-get install certbot python-certbot-apache -t stretch-backports

sudo certbot certonly --cert-name CERTNAME --server https://acme-v02.api.letsencrypt.org/directory --manual --preferred-challenges dns -d 'DOMAIN.co,*.DOMAIN.co'

After the DNS setup, it created the certificate. But now I don't want to deal with it every 90 days for renewal. I've been looking for a good solution for a Cron Job. The problem with most Cron Job solutions is that they are for non-wildcard domains.

I like this solution which checks every day if the certificate can be renewed and renews it if it allows itself to:

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot renew

The problem with wildcard certificates is that it has a DNS setup component and certbot renew doesn't work with manual certbot setup.

I am looking for a Cron Job that is like this:

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot certonly --cert-name CERTNAME --server https://acme-v02.api.letsencrypt.org/directory --manual --preferred-challenges dns -d 'DOMAIN.co,*.DOMAIN.co'

But I don't think this will work with the DNS setup.

How can I create a Cron Job to renew wildcard certificates property and efficiently?

Answer 1

I solved this problem by switching to acme.sh instead of certbot.

Documentation on current versions of certbot (1.30-5) say it can do automated wildcard renewals (DNS-01), but Debian buster stable doesn't yet include a version that does (0.31.0-5). I couldn't get past the limitation.

I found acme.sh as easy to implement and more easy to understand that certbot. My DNS provider is Cloudflare. The support across both solutions is good.