Let's Encrypt certificates don't autorenew

Community Support General Questions
1

Since I have started using HestiaCP I always had issues with certificates not getting renewed. I did not have time to troubleshoot it and simply re-enabled certificates via panel or used “v-add-letsencrypt-hostl”, however it’s time to fix this for good.

I do use CloudFlare and it is set to “Strict” as recommended in the docs. Also I proxy the requests/hide server IP with CF. However I don’t understand what does HestiaCP use to run the autorenewal? There is no acme.sh nor cron jobs for this.

Could someone help and suggest in which direction I should head?

This is for example what happened last time with main HestiaCP domain, but it started working out fine and cerficiate got renewed despite having errors:

root@myserver:~# v-add-letsencrypt-host
Could not open file or uri for loading certificate file from /usr/local/hestia/data/users/admin/ssl/mydomain.tld.pem
80DB1ACEE17F0000:error:16000069:STORE routines:ossl_store_get0_loader_int:unregistered scheme:../crypto/store/store_register.c:237:scheme=file
80DB1ACEE17F0000:error:80000002:system library:file_open:No such file or directory:../providers/implementations/storemgmt/file_store.c:267:calling stat(/usr/local/hestia/data/users/admin/ssl/mydomain.tld.pem)
Unable to load certificate file

Running HestiaCP v1.9.4 on Debian 12.12

Running crontab -l shows no cron tasks for root or any other Hestia user… I think something is missing on my part, but I don’t understand how did I miss such critical thing. The setup of the panel went smoothly and without any problems.

1 Like
2

Hestia uses a cron job to run v-update-letsencrypt-ssl every day.

crontab -l -u hestiaweb | grep v-update-letsencrypt-ssl

All the cron jobs to manage Hestia run under user hestiaweb.

Next time check the log /var/log/hestia/LE-YourUser-YourDomain.log

3 Likes
3

First of all thank you! Intresting.

I tried to run as root crontab -l -u hestiaweb | grep v-update-letsencrypt-ssl

But got nothing in return. But running this one worked:

root@enter:~# crontab -l -u hestiaweb
*/5 * * * * sudo /usr/local/hestia/bin/v-update-letsencrypt

It seems like the cron job is incorrect v-update-letsencrypt instead of v-update-letsencrypt-ssl? Don’t understand how did that happen. How can I restore proper cron job for Let’s Encrypt auto renewal?

4

Edit the crontab and modify the line manually:

crontab -e -u hestiaweb

Also, that cron job is running every 5 minutes and it should run once a day, use something like this:

11 2 * * * sudo /usr/local/hestia/bin/v-update-letsencrypt-ssl
2 Likes
5

Thanks a lot! I made the changes and replaced old cronjob with the one you provided. Hopefully everything goes smoothly next time :slight_smile:

1 Like