certbot-auto is being deprecated and does not work on Ubuntu 18.04.5

[smacz42]

Per https://github.com/certbot/certbot/issues/7941#issuecomment-619177149 the certbot-auto functionality is being deprecated and does not work on 20.04:

TASK [certbot : Generate new certificate if one doesn't exist.] ****************
--
21:34:37 |   | fatal: [hostname]: FAILED! => {
21:34:37 |   | "changed": true,
21:34:37 |   | "cmd": [
21:34:37 |   | "/opt/certbot/certbot-auto",
21:34:37 |   | "certonly",
21:34:37 |   | "--standalone",
21:34:37 |   | "--noninteractive",
21:34:37 |   | "--agree-tos",
21:34:37 |   | "--email",
21:34:37 |   | "user@example.com",
21:34:37 |   | "-d",
21:34:37 |   | "example.com"
21:34:37 |   | ],
21:34:37 |   | "delta": "0:00:00.030074",
21:34:37 |   | "end": "2020-12-02 02:34:37.844875",
21:34:37 |   | "rc": 1,
21:34:37 |   | "start": "2020-12-02 02:34:37.814801"
21:34:37 |   | }
21:34:37 |   |  
21:34:37 |   | STDOUT:
21:34:37 |   |  
21:34:37 |   | Skipping bootstrap because certbot-auto is deprecated on this system.
21:34:37 |   | WARNING: couldn't find Python 2.7+ to check for updates.
21:34:37 |   | Your system is not supported by certbot-auto anymore.
21:34:37 |   | Certbot cannot be installed.
21:34:37 |   | Please visit https://certbot.eff.org/ to check for other alternatives.

[smacz42]

This happens when called with certbot_install_from_source: False on Debian systems. Right now it looks like the certbot version is 0.27.0-1 in the ubuntu repos for 18.04.5.

See: https://community.letsencrypt.org/t/certbot-1-10-0-release/139518

[sermo-de-arboribus]

This also happens with certbot_install_from_source: True

The new recommended way of installing certbot is explained in this thread: https://community.letsencrypt.org/t/certbot-auto-no-longer-works-on-debian-based-systems/139702/7

[Blake-]

From the new recommended way.

How do I install Certbot now?
The way we recommend most users install Certbot is through snaps.

I'm not a big fan of snaps, but I guess that means a new task install via snap ?

[willemdh]

Similar issue for CentOS 8. IETF also recommends snap as install method apparently.. https://certbot.eff.org/lets-encrypt/centosrhel8-apache 😕

[mikejw]

I've come up with this little workaround. It's hacky.

Also remove any use of the --standalone flag in your commands and use --apache.

I don't understand why thecertbot_dir and certbot_script variables can't be overridden (on cert creation etc), so that's why I've done the following. (On Ubunutu 18.)

# install snap certbot
- hosts: build
  vars:
  tasks:
    - name: Install from apt
      apt:
        name: "{{ packages }}"
        state: present
      vars:
        packages:
          - certbot
          - snapd
          - apache2
    - name: "Install snap core"
      snap:
        name:
          - core
    - name: "Install snap certbot"
      snap:
        name: certbot
        classic: yes
    - name: "Rename old"
      command: mv /usr/bin/certbot /usr/bin/certbot.old
    - name: "Create link"
      file:
        path=/usr/bin/certbot
        src=/snap/bin/certbot
        state=link

[geerlingguy]

Yeah... this is happening on CentOS 7 too.

TASK [geerlingguy.certbot : Generate new certificate if one doesn't exist.] ********************************************
fatal: [servercheck.in]: FAILED! => {"changed": true, "cmd": ["/opt/certbot/certbot-auto", "certonly", "--standalone", "--noninteractive", "--agree-tos", "--email", "webmaster@midwesternmac.com", "-d", "servercheck.in"], "delta": "0:00:00.234317", "end": "2021-01-19 10:07:34.164997", "msg": "non-zero return code", "rc": 1, "start": "2021-01-19 10:07:33.930680", "stderr": "", "stderr_lines": [], "stdout": "Skipping bootstrap because certbot-auto is deprecated on this system.\nYour system is not supported by certbot-auto anymore.\nCertbot cannot be installed.\nPlease visit https://certbot.eff.org/ to check for other alternatives.", "stdout_lines": ["Skipping bootstrap because certbot-auto is deprecated on this system.", "Your system is not supported by certbot-auto anymore.", "Certbot cannot be installed.", "Please visit https://certbot.eff.org/ to check for other alternatives."]}

How annoying. Snaps are dumb :P

[geerlingguy]

On CentOS 7, I installed snap and then installed certbot. Highly annoying:

# Oh snap.
sudo yum install snapd  # Requires EPEL
sudo systemctl enable --now snapd.socket
sudo ln -s /var/lib/snapd/snap /snap  # Enable classic snap support

# Install certbot.
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

# Get a cert.
sudo certbot certonly --standalone --noninteractive --agree-tos --email 'email@example.com' -d example.com

# Test a renewal.
sudo certbot renew --dry-run

[geerlingguy]

Working on this in https://github.com/geerlingguy/ansible-role-certbot/pull/142

[rgarrigue]

For whoever got a veto on snap, I changed from certbot to lego. Writing a role to get the bin from github etc was quite easy. Got the same functionality in the end.

[geerlingguy]

There's also acme.sh :)