Reload server on certificate renewal

[jonstra]

Hi, I did the following steps and I'm unsure how to best implement --reloadcmd "service nginx force-reload".

1. curl https://get.acme.sh | sh
2. acme.sh --issue --dns dns_nsone -d just.examle.io -d www.just.example.io
3. edit /etc/nginx/sites-enabled/example-web
   • ssl_certificate /home/myuser/.acme.sh/just.example.io/just.example.io.cer;
   • ssl_certificate_key /home/myuser/.acme.sh/just.example.io/just.example.io.key;
4. verify cronjob
   • 11 0 * "/home/myuser/.acme.sh"/acme.sh --cron --home "/home/myuser/.acme.sh" > /dev/null

When running the cronjob it checks if the certificate needs to be renewed. It seems like this worked the last time around, but that the nginx server was not reloaded with the new certificates.

How can i enable the reload nginx command to run only after the cert has been renewed? Thanks.

[jonstra]

11 0 * "/home/myuser/.acme.sh"/acme.sh --cron --reloadcmd "service nginx reload" --home "/home/myuser/.acme.sh" > /dev/null ?

[Neilpang]

Never, Never modify the default cron job, unless you are an expert in acme.sh.

Use --instal-cert:

https://github.com/Neilpang/acme.sh#3-install-the-cert-to-apachenginx-etc

acme.sh  --install-cert  -d example.com  --reload-cmd "service nginx reload"

[jonstra]

Hi, So i edited my sites-enabled/example-web manually earlier. The reason i did not use --install-cert was because i was not exactly sure what it does to my configuration, and i didnt want to break my server.

Can you explain what is being updated? Thanks.

[Neilpang]

First, please follow the steps in the readme file, it's the best practice.

Never edit your site conf to use the cert/key files in the .acme.sh/ home folder.

https://github.com/Neilpang/acme.sh#3-install-the-cert-to-apachenginx-etc

DO NOT use the certs files in ~/.acme.sh/ folder, they are for internal use only, the folder structure may change in the future.

acme.sh  --issue -d example.com ....

acme.sh  --install-cert -d example.com   --keyfile xxx --cert-file xxx   --reloadcmd xxxxx

Second, --install-cert doesn't modify any of your site conf files. it just copies the cert/key files to the specified location and/or restart/reload your server by --reloadcmd xxxxx.

[jonstra]

Ok. I think the heading was misleading. So you don't actually install anything, but just copy the files to another directory, except when adding --reloadcmd.

[Arlen22]

If I have already run install-cert once, will running it again with a new reloadcmd update the reloadcmd? I'm not sure how to change the reloadcmd once I have it set.

[Neilpang]

@Arlen22

will running it again with a new reloadcmd update the reloadcmd?

Yes.

[rajaws2015]

Hi, I followed the below steps: acme.sh --issue --nginx -d example.com .... acme.sh --install-cert -d example.com --keyfile xxx --cert-file xxx --reloadcmd "service nginx force-reload"

My cronjob is : 29 0 * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null I've never modified it. Do i need to modify for the autonrewal process? Since when I test it with "renew" command, it is showing the next renewal time (before 30 days).

Please advice me. Thanks Raj

[konkhra]

Hi!

I am reviving this thread as I am facing the same question as OP and seems that the previous answers doesn't answer the exact question.

I issue certificates for 5 different domains using this command:

acme.sh --issue -d example.com --insecure --force -k ec-256 --log -w /var/www/letsencrypt/

Is this cron job 20 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null automatically reloading the nginx service after renewing the certificates?

If the answer is NO what is the full cron job command that ensures the NGINX service is reloaded?