3

I am using kernel 3.10 on CentOS 7. I have successfully installed CertBot 1.10.1 using alternative installation instructions as certbot-auto. Running certbot-auto successfully generated certificates for my nginx (1.7.8) installation. Simulating renewal with the sudo /usr/local/bin/certbot-auto renew --dry-run was also successful.

The problem is that I can not find/confirm that certbot is actually installed for automatic launch. Docs indicate that CentOS EPEL 7 should use systemd. However, running systemctl list-timers --all indicate that there is no timer set up for CertBot. There is nothing in /etc/systemd/system/ related to CertBot. I have checked crontab -l just in case -- nothing.

Why there is no auto-renewal set up?

Is it a mistake in the docs, or am I missing something?

Should I look elsewhere? Should I create the timer/job manually?

certbot 1.10.1

nginx 1.7.8

kernel 3.10.0-123.20.1.el7.x86_64

NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

P.S. I have used alternative installation method, because the default CertBot's installation with snapd does not work -- it complains:

error: system does not fully support snapd: cannot read the value of
         fs.may_detach_mounts kernel parameter: open
         /proc/sys/fs/may_detach_mounts: no such file or directory

which I assume means that my kernel version is too old for snapd to work.

0

I have manually added certbot-auto to autorun via systemd by creating the following files:

/etc/systemd/system/certbot-renewal.service:

[Unit]
Description=Certbot Renewal

[Service]
ExecStart=/usr/local/bin/certbot-auto renew --quiet

/etc/systemd/system/certbot-renewal.timer:

[Unit]
Description=Timer for Certbot Renewal

[Timer]
OnBootSec=1h
OnUnitActiveSec=1d

[Install]
WantedBy=multi-user.target

And running the following command: systemctl enable --now certbot.timer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.