eWaterCycle / infra

Instructions for system administrators to deploy the eWaterCycle platform
Apache License 2.0
0 stars 0 forks source link

https cert not renewed #136

Closed sverhoeven closed 1 year ago

sverhoeven commented 1 year ago

On one of the Virtual Machines the https cert was no longer being renewed.

`journalctl -u certbot` logs ```bash Jan 22 19:39:24 host-192-168-0-170 systemd[1]: Starting Certbot... Jan 22 19:39:24 host-192-168-0-170 certbot[1490357]: Attempting to renew cert (demo2.ewatercycle-nle.src.surf-hosted.nl) from /etc/letsencrypt/renewal/demo2.ewatercycle-nle.src.surf-hosted.nl.conf p> Jan 22 19:39:24 host-192-168-0-170 certbot[1490357]: All renewal attempts failed. The following certs could not be renewed: Jan 22 19:39:24 host-192-168-0-170 certbot[1490357]: /etc/letsencrypt/live/demo2.ewatercycle-nle.src.surf-hosted.nl/fullchain.pem (failure) Jan 22 19:39:24 host-192-168-0-170 certbot[1490357]: 1 renew failure(s), 0 parse failure(s) Jan 22 19:39:24 host-192-168-0-170 systemd[1]: certbot.service: Main process exited, code=exited, status=1/FAILURE Jan 22 19:39:24 host-192-168-0-170 systemd[1]: certbot.service: Failed with result 'exit-code'. Jan 22 19:39:24 host-192-168-0-170 systemd[1]: Failed to start Certbot. ```
Certbot renew output ```bash usr/bin/certbot -q renew Attempting to renew cert (demo2.ewatercycle-nle.src.surf-hosted.nl) from /etc/letsencrypt/renewal/demo2.ewatercycle-nle.src.surf-hosted.nl.conf produced an unexpected error: module 'lib' has no attribute 'X509_get_notAfter'. Skipping. All renewal attempts failed. The following certs could not be renewed: /etc/letsencrypt/live/demo2.ewatercycle-nle.src.surf-hosted.nl/fullchain.pem (failure) ```
sverhoeven commented 1 year ago

Somehow a certbot dependency has wrong version.

Corrected by installing certbot with snap.