Automatic renewal of Lets Encrypt certificates

[pscriptos]

Hello everyone,

Thank you for your good work.

I (and two other of my friends) all have the same problem:
The Letsencrypt certificates we generated with CloudPanel do not renew automatically.

Is this behavior correct or is there a way to automate this?
I have some services that I make accessible to the internet with my CloudPanel and I don't want to sit down every three months to renew the certificates manually.

Has anyone had a similar problem and been able to solve it?

Thank you all very much.
Regards, Patrick

[pscriptos]

Does nobody here have the same behaviour? My certificates expire again in 21 days and I have to renew them manually.

Is there a log where I can run checks? Is there any other approach I can check?

There must be some way to fix the problem.

[pscriptos]

Hello everyone,

I just wanted to get back to you and let you know that I was able to solve the problem myself.

Since I have many DNS/domains, I have written a script which automatically renews the certificates.
I run this script as a cronjob and that takes care of the issue for me.

I am making the script available here for those who have the same problem:
https://git.techniverse.net/scriptos/cloudpanel-autorenew-letsencrypt-certs.git

Greetings, Patrick

[pscriptos]

hi, i am getting an error:

I took the time this evening to revise my script.
The script now also supports alternative DNS names.
https://git.techniverse.net/scriptos/cloudpanel-autorenew-letsencrypt-certs

Please try it again.

I wish you a good evening.

[razametal]

Hi @pscriptos , I've installed the new version, the log after running the script with bash cloudpanel-autorenew-letsencrypt-certs.v1.sh :

`Das Zertifikat für produinnova.ec,produinnova.ec,www1.produinnova.ec,produinnova.ec,www1.produinnova.ec läuft in weniger als 14 Tagen ab (in 0 Tagen).
Erneuere/Erstelle Zertifikat für: produinnova.ec
produinnova.ec
produinnova.ec mit alternativen Namen: produinnova.ec,produinnova.ec,www1.produinnova.ec,produinnova.ec,www1.produinnova.ec
{"message":"Error thrown while running command "lets-encrypt:install:certificate '\$\'\''--domainName=produinnova.ec\\nproduinnova.ec\\nproduinnova.ec\'\''' --subjectAlternativeName='produinnova.ec,produinnova.ec,www1.produinnova.ec,produinnova.ec,www1.produinnova.ec'". Message: "No arguments expected for "lets-encrypt:install:certificate" command, got "\$\'--domainName=produinnova.ec\\nproduinnova.ec\\nproduinnova.ec\'"."","context":{"exception":{"class":"Symfony\Component\Console\Exception\RuntimeException","message":"No arguments expected for "lets-encrypt:install:certificate" command, got "\$\'--domainName=produinnova.ec\\nproduinnova.ec\\nproduinnova.ec\'".","code":0,"file":"/home/clp/htdocs/app/files/vendor/symfony/console/Input/ArgvInput.php:193"},"command":"lets-encrypt:install:certificate '\$\'\''--domainName=produinnova.ec\\nproduinnova.ec\\nproduinnova.ec\'\''' --subjectAlternativeName='produinnova.ec,produinnova.ec,www1.produinnova.ec,produinnova.ec,www1.produinnova.ec'","message":"No arguments expected for "lets-encrypt:install:certificate" command, got "\$\'--domainName=produinnova.ec\\nproduinnova.ec\\nproduinnova.ec\'"."},"level":500,"level_name":"CRITICAL","channel":"console","datetime":"2024-07-02T22:45:41.237799+00:00","extra":{}}
22:45:41 CRITICAL [console] Error thrown while running command "lets-encrypt:install:certificate '$'''--domainName=produinnova.ec\nproduinnova.ec\nproduinnova.ec'''' --subjectAlternativeName='produinnova.ec,produinnova.ec,www1.produinnova.ec,produinnova.ec,www1.produinnova.ec'". Message: "No arguments expected for "lets-encrypt:install:certificate" command, got "$'--domainName=produinnova.ec\nproduinnova.ec\nproduinnova.ec'"." ["exception" => Symfony\Component\Console\Exception\RuntimeException { …},"command" => "lets-encrypt:install:certificate '$'''--domainName=produinnova.ec\nproduinnova.ec\nproduinnova.ec'''' --subjectAlternativeName='produinnova.ec,produinnova.ec,www1.produinnova.ec,produinnova.ec,www1.produinnova.ec'","message" => "No arguments expected for "lets-encrypt:install:certificate" command, got "$'--domainName=produinnova.ec\nproduinnova.ec\nproduinnova.ec'"."]
{"message":"Command "lets-encrypt:install:certificate '\$\'\''--domainName=produinnova.ec\\nproduinnova.ec\\nproduinnova.ec\'\''' --subjectAlternativeName='produinnova.ec,produinnova.ec,www1.produinnova.ec,produinnova.ec,www1.produinnova.ec'" exited with code "1"","context":{"command":"lets-encrypt:install:certificate '\$\'\''--domainName=produinnova.ec\\nproduinnova.ec\\nproduinnova.ec\'\''' --subjectAlternativeName='produinnova.ec,produinnova.ec,www1.produinnova.ec,produinnova.ec,www1.produinnova.ec'","code":1},"level":100,"level_name":"DEBUG","channel":"console","datetime":"2024-07-02T22:45:41.267895+00:00","extra":{}}

No arguments expected for "lets-encrypt:install:certificate" command, got "$'-
-domainName=produinnova.ec\nproduinnova.ec\nproduinnova.ec'".

lets-encrypt:install:certificate [--domainName DOMAINNAME] [--subjectAlternativeName [SUBJECTALTERNATIVENAME]]

Could not read certificate from
Unable to load certificate
Das Zertifikat für vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com läuft in weniger als 14 Tagen ab (in 0 Tagen).
Erneuere/Erstelle Zertifikat für: vanniaccesorios.com
vanniaccesorios.com
vanniaccesorios.com mit alternativen Namen: vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com
{"message":"Error thrown while running command "lets-encrypt:install:certificate '\$\'\''--domainName=vanniaccesorios.com\\nvanniaccesorios.com\\nvanniaccesorios.com\'\''' --subjectAlternativeName='vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com'". Message: "No arguments expected for "lets-encrypt:install:certificate" command, got "\$\'--domainName=vanniaccesorios.com\\nvanniaccesorios.com\\nvanniaccesorios.com\'"."","context":{"exception":{"class":"Symfony\Component\Console\Exception\RuntimeException","message":"No arguments expected for "lets-encrypt:install:certificate" command, got "\$\'--domainName=vanniaccesorios.com\\nvanniaccesorios.com\\nvanniaccesorios.com\'".","code":0,"file":"/home/clp/htdocs/app/files/vendor/symfony/console/Input/ArgvInput.php:193"},"command":"lets-encrypt:install:certificate '\$\'\''--domainName=vanniaccesorios.com\\nvanniaccesorios.com\\nvanniaccesorios.com\'\''' --subjectAlternativeName='vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com'","message":"No arguments expected for "lets-encrypt:install:certificate" command, got "\$\'--domainName=vanniaccesorios.com\\nvanniaccesorios.com\\nvanniaccesorios.com\'"."},"level":500,"level_name":"CRITICAL","channel":"console","datetime":"2024-07-02T22:45:41.769956+00:00","extra":{}}
22:45:41 CRITICAL [console] Error thrown while running command "lets-encrypt:install:certificate '$'''--domainName=vanniaccesorios.com\nvanniaccesorios.com\nvanniaccesorios.com'''' --subjectAlternativeName='vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com'". Message: "No arguments expected for "lets-encrypt:install:certificate" command, got "$'--domainName=vanniaccesorios.com\nvanniaccesorios.com\nvanniaccesorios.com'"." ["exception" => Symfony\Component\Console\Exception\RuntimeException { …},"command" => "lets-encrypt:install:certificate '$'''--domainName=vanniaccesorios.com\nvanniaccesorios.com\nvanniaccesorios.com'''' --subjectAlternativeName='vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com'","message" => "No arguments expected for "lets-encrypt:install:certificate" command, got "$'--domainName=vanniaccesorios.com\nvanniaccesorios.com\nvanniaccesorios.com'"."]
{"message":"Command "lets-encrypt:install:certificate '\$\'\''--domainName=vanniaccesorios.com\\nvanniaccesorios.com\\nvanniaccesorios.com\'\''' --subjectAlternativeName='vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com'" exited with code "1"","context":{"command":"lets-encrypt:install:certificate '\$\'\''--domainName=vanniaccesorios.com\\nvanniaccesorios.com\\nvanniaccesorios.com\'\''' --subjectAlternativeName='vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com,vanniaccesorios.com,www1.vanniaccesorios.com'","code":1},"level":100,"level_name":"DEBUG","channel":"console","datetime":"2024-07-02T22:45:41.800156+00:00","extra":{}}

No arguments expected for "lets-encrypt:install:certificate" command, got "$'-
-domainName=vanniaccesorios.com\nvanniaccesorios.com\nvanniaccesorios.com'".

lets-encrypt:install:certificate [--domainName DOMAINNAME] [--subjectAlternativeName [SUBJECTALTERNATIVENAME]]

`

[pscriptos]

What version does your CloudPanel run on?
Something has to be different from mine.

[pscriptos]

Can you show me a configuration like this?
I would like to see it so that I can understand what is going wrong here.
Have you changed anything in the script?

[afinucane]

Hello! Thank you for this script. I've installed and configured it but am getting the same errors as listed above for my domains. I'm running the script manually on version 2.4.2.

[cvladan]

Since this doesn't work for me either, I'm almost certain that CloudPanel doesn't automatically renew Let's Encrypt certificates. I'll try @pscriptos script - thanks @pscriptos !

[AKhateeb]

I have the same problem, which is frustrating to renew all sites in my CloudPanel server manually.
I found this answer but it seems not valid, so I ended up adding a cronjob for each site to renew the certificate using certbot

[pscriptos]

Otherwise, you can use the script I linked above. I still use it and it works fine for me.

[Tangol]

[SchiWaGoA78]

Hej @Tangol .
I have checked the file in /etc/cron.d/clp and the permissions are 644.
The content of the clp-file is:
MAILTO="" 5 0 * * * clp /usr/bin/sudo /etc/init.d/rsyslog restart &> /dev/null 15 2 * * * clp /usr/bin/sudo /usr/bin/systemctl restart clp-agent &> /dev/null 10 3 * * * clp /usr/bin/bash -c "/usr/bin/clpctl monitoring:data:clean" &> /dev/null 15 3 * * * clp /usr/bin/bash -c "/usr/bin/clpctl db:backup --ignoreDatabases='db1,db2' --retentionPeriod=7" &> /dev/null 15 4 * * * clp /home/clp/scripts/create_backup.sh &> /dev/null 10 5 * * * clp /usr/bin/bash -c "/usr/bin/clpctl lets-encrypt:renew:custom-domain:certificate" &> /dev/null 15 5 * * * clp /usr/bin/bash -c "/usr/bin/clpctl lets-encrypt:renew:certificates" &> /dev/null 15 6 * * * clp /usr/bin/bash -c "/usr/bin/clpctl vhost-templates:import --delay=true" &> /dev/null 20 6 * * * clp /usr/bin/bash -c "/usr/bin/clpctl cloudflare:update:ips --delay=true" &> /dev/null 0 */8 * * * clp /usr/bin/bash -c "/usr/bin/clpctl announcement:check" &> /dev/null
Is this correct !?

Thanks :)

[ccMatrix]

You can download the deb file from here: https://d17k9fuiwb52nc.cloudfront.net/pool/main/c/cloudpanel/
then extract the file directly from the install file. I recommend the bookworm deb file since the debian format is easier opened with any archive tool than the ubuntu variants.

[n3storm]

Just for admins that ended in this issue assure them CloudPanel does renew Lets Encrypt certificates if:

• You installed CloudPanel in a just installed distribution
• You don't mess up with the operating system outside what CloudPanel docs recommends.

[fedeandri]

Same problem here, I suspect there's a bug somewhere.

I installed CloudPanel on a Vultr VPS via their app marketplace.
I'm on the latest version (2.4.2) and I didn't mess with the operating system apart from updating Ubuntu from time to time, but when manually launching the command that's supposed to auto-renew Let's Encrypt certificates I get the error:
"There are no commands defined in the "lets-encrypt:renew" namespace."

And launching /usr/bin/clpctl doesn't show me any command related to renewing let's encrypt certificates, which doesn't seem to be normal, given that the cron job configured by CP itself is trying to use it.

So I either inadvertently screwed up my CP install (I wouldn't know how, though) or there's a bug somewhere.
Should I open an issue?

[TheBnl]

Running into a similar situation as @fedeandri seems i'm missing those commands as wel.
Running version 2.4.2 of cloudpanel, installed on Ubuntu 24.04 LTS since august.

[ccMatrix]

The commands for renewal are run by the clp user only. You will not see them as site user or root.
sudo -u clp bash -c "/usr/bin/clpctl" can show you the commands available for the clp user.

[cloudpanel-io]

To renew the certificates as root user, you can execute the following command:

su -s /bin/bash -c '/usr/bin/clpctl lets-encrypt:renew:certificates' clp

[TheBnl]

@ccMatrix thanks for the clarification, i see te commands as the clp user 👍

[varian-tan]

@ccMatrix
im running cloudlanel 2.5.0 on ubuntu 24.
in my case, the "/etc/cron.d/clp" does not exist. instead, the cron listed with different name "/etc/cron.d/clp.dpkg-dist"
can i just change it from clp.dpkg-dist to clp?

[borgeserick]

I was having a lot of issues with Let's Encrypt certificate expiration as well, so what I did was keep all my domains on Cloudflare and use Cloudflare's default SSL configuration. It doesn't expire, and you don't have to worry about renewing it anymore.

[pixelpadre]

Has anyone figured out how to get a cert for the port 8443. Can we/should we change the config file to direct it to the valid cert for port 443.

The port 8443 still uses a self-signed cert

There's no clean way to use the site-issued Let's Encrypt cert

Renewal and replacement isn’t integrated into CloudPanel’s own admin pane

[medhallal]

I have the same issue, did you manage to fix it?

[andreasoc]

I fixed it, if you work behind a corporate firewall, both port 80 and 443 must be nat to the host