How do you automate certificate renewals with the certbot Docker image?

[vahidalvandi]

in this link https://eff-certbot.readthedocs.io/en/latest/using.html#automated-renewals after run
SLEEPTIME=$(awk 'BEGIN{srand(); print int(rand()*(3600+1))}'); echo "0 0,12 * * * root sleep $SLEEPTIME && certbot renew -q" | sudo tee -a /etc/crontab > /dev/null return unable to resolve host email-server: Name or service not known but after run bellow work fine

docker run --rm -it \
  -v "${PWD}/docker-data/certbot/certs/:/etc/letsencrypt/" \
  -v "${PWD}/docker-data/certbot/logs/:/var/log/letsencrypt/" \
  -p 80:80 \
  -p 443:443 \
  certbot/certbot renew

please show how i can run top renew in crontab

[polarathene]

in this link https://eff-certbot.readthedocs.io/en/latest/using.html#automated-renewals after run
SLEEPTIME=$(awk 'BEGIN{srand(); print int(rand()*(3600+1))}'); echo "0 0,12 * * * root sleep $SLEEPTIME && certbot renew -q" | sudo tee -a /etc/crontab > /dev/null return unable to resolve host email-server: Name or service not known

That is advice for the certbot command if you have it installed locally without a Docker container.

You would need to have successfully provisioned the certificate on the host system instead for that to work.

---

please show how i can run top renew in crontab

You can configure a systemd timer or cron job to perform the docker run command (that uses the certbot container for renew).

If you still prefer to use a cron job, replace the certbot renew -q portion with an executable script that runs that docker run ... command 👍

Note

• In both cases these are running the container with expectation of port 80 + 443 to not already be in use.
• If you have a reverse proxy on the system you'll need not publish ports with this docker run, perhaps use a compose.yaml and docker compose run ... or similar, and ensure that the reverse proxy is already running (with systemd timer, you can use a separate service unit as a dependency requirement that manages your reverse proxy service).

Systemd Timer example

Create two files (service unit for command + timer unit):

/etc/systemd/system/dms-certbot-renew.service:

[Unit]
Description=DMS certificates renewal

[Service]
Type=oneshot
ExecStart=docker run --rm -it \
  -v "/path/to/docker-data/certbot/certs/:/etc/letsencrypt/" \
  -v "/path/to/docker-data/certbot/logs/:/var/log/letsencrypt/" \
  -p 80:80 \
  -p 443:443 \
  certbot/certbot renew

/etc/systemd/system/dms-certbot-renew.timer:

[Unit]
Description=Timer for DMS certificates renewal

[Timer]
Persistent=true
OnCalendar=daily
# Daily (long-form syntax) at 4am instead of midnight (local timezone):
#OnCalendar=*-*-* 4:00:00
# Alternatively, twice daily (randomly within their 12 hour span):
#OnCalendar=*-*-* 00,12:00:00
#RandomizedDelaySec=43200

[Install]
WantedBy=timers.target

Then activate the timer:

# `--now` is equivalent to `systemctl start ...` (activate timer)
# `systemctl enable ...` persists timer activation across reboots
systemctl enable --now dms-certbot-renew.timer

# Inspect timer status or service logs:
systemctl status dms-certbot-renew.timer
systemctl list-timers
journalctl -u dms-certbot-renew.service

Note

• It's generally advised to have two checks daily at random minute, rather than a common default time like midnight (aka OnCalendar=daily), so you may want to adjust that (I provided some comments for context on how).
• Also in future EFF may advise you to check more frequently than twice daily.

References:

• https://wiki.archlinux.org/title/Systemd
• https://wiki.archlinux.org/title/Systemd/Timers
• https://stevenwestmoreland.com/2017/11/renewing-certbot-certificates-using-a-systemd-timer.html
• https://k4yt3x.com/automatically-renew-certbot-certificates-with-systemd-timers/
• https://www.gregchapple.com/auto-renew-lets-encrypt-certs-with-systemd-timers/

[ddbreyer]

Thank you. However I got the error the input device is not a TTY

For everyone getting this error, I solved it by doing the following in the dms-certbot-renew.service:

[Unit]
Description=DMS certificates renewal

[Service]
Type=oneshot
ExecStart=docker run --rm -t \
  -v "/path/to/docker-data/certbot/certs/:/etc/letsencrypt/" \
  -v "/path/to/docker-data/certbot/logs/:/var/log/letsencrypt/" \
  -p 80:80 \
  -p 443:443 \
  certbot/certbot renew

I removed the interactive parameter from docker run command.

Do a systemctl daemon-reload and verify it works by manually running the service with systemctl start dms-certbot-renew.service you can check with journalctl -u dms-certbot-renew.service like polarathene said.

[gift-sequoiaat]

Thank you

[vahidalvandi]

thak you work fined

[vule20]

I have nginx running on port 80 and 443 already. I haven't tried, however, I wonder ifI I put entrypoint: /bin/sh -c 'trap exit TERM; while :; do certbot renew --deploy-hook "touch /var/reload-nginx/reload"; sleep 12h & wait $${!}; done;' will also renew for cerfs for docker mailserver ?

[polarathene]

Then configure nginx to route to the certbot container like you would any other container? Or temporarily disable nginx and use the certbot container?

Alternatively, use a proxy service that routes to containers for you. We already document nginx-proxy.

Certbot could also perform an alternative DNS challenge instead, but that will depend on support from your DNS provider. We provide an example with Cloudflare in our docs.