Helpful error message is blocking execution?

[mpking828]

I was provided this script by someone else to allow a Milestone Camera System to use Let's Encrypt. It's worked great for a few years.

    param([string]$LogPath)

    function WriteLog {
        Param ([string]$message)
        Add-Content -Path $LogPath -Value "$(Get-Date) - $message"
    }

    try {
        $thumbprint = (Get-PACertificate).Thumbprint
        $cert = Submit-Renewal -WarningAction Stop -ErrorAction Stop
        $cert | Set-MobileServerCertificate  #Activate the certificate
        WriteLog "New certificate installed with thumbprint $($cert.Thumbprint)"
        WriteLog "Removing old certificate with thumbprint $thumbprint"
        Get-ChildItem Cert:\LocalMachine\My |
            Where-Object Thumbprint -eq $thumbprint |
            Remove-Item

    } catch {
        WriteLog $_.Exception.Message
        throw
    }

Usually it just puts this error in the log daily: 10/14/2024 03:04:11 - The running command stopped because the preference variable "WarningPreference" or common parameter is set to Stop: Order 'host.domain.com' is not recommended for renewal yet. Use -Force to override.

However, starting on the 19th it started throwing this error: 10/19/2024 03:37:25 - The running command stopped because the preference variable "WarningPreference" or common parameter is set to Stop: The ACME Server has indicated this order's certificate should be renewed AS SOON AS POSSIBLE.

I got an email today from Let'sEncrypt that the certificate expires on the 17th of Nov (it's what triggered me to check the error log)

That is the problem I'm trying to fix.

Looks like the helpful error message saying renew now is triggering the exception logic.

Here is my first attempt to fix it. (Essentially just adding the IF statement from https://poshac.me/docs/latest/Tutorial/#task-scheduler-cron).

Think this will get the job done? I'm open to suggestions

    param([string]$LogPath)

    function WriteLog {
        Param ([string]$message)
        Add-Content -Path $LogPath -Value "$(Get-Date) - $message"
    }

    try {
        $thumbprint = (Get-PACertificate).Thumbprint
        if ($cert = Submit-Renewal) {
            $cert | Set-MobileServerCertificate #Activate the certificate
            WriteLog "New certificate installed with thumbprint $($cert.Thumbprint)"
            WriteLog "Removing old certificate with thumbprint $thumbprint"
            Get-ChildItem Cert:\LocalMachine\My |
                Where-Object Thumbprint -eq $thumbprint |
                Remove-Item
        }
        else {
            WriteLog "Certificate was not renewed")
        }
    } catch {
        WriteLog $_.Exception.Message
        throw
    }

[rmbolger]

Hi @mpking828, thanks for reaching out. Looks like you already got it figured out. But yes, warnings aren't intended to stop script execution so the -WarningAction Stop was the main cause of your issue. You might want to put the -ErrorAction Stop back in though which will make it more likely that your catch statement will correctly catch and log any actual errors.

[mpking828]

Reporting back.

My code was throwing a syntax error. Co-Pilot corrected it this way: `param([string]$LogPath)

function WriteLog { Param ([string]$message) Add-Content -Path $LogPath -Value "$(Get-Date) - $message" }

try { $thumbprint = (Get-PACertificate).Thumbprint $cert = Submit-Renewal -ErrorAction Stop if ($cert) { $cert | Set-MobileServerCertificate WriteLog "New certificate installed with thumbprint $($cert.Thumbprint)" WriteLog "Removing old certificate with thumbprint $thumbprint" Get-ChildItem Cert:\LocalMachine\My | Where-Object Thumbprint -eq $thumbprint | Remove-Item } else { WriteLog "Certificate was not renewed" } } catch { WriteLog $_.Exception.Message throw } `

I guess this is more a powershell question than a Posh-ACME question, but when it does the Submit-Renewal, if you run it from the command prompt, you get messages like: Order 'host.domain.com' is not recommended for renewal yet. Use -Force to override. Any way I can capture that (again) and write it to the log?