2017-08-01 46 views
0

今天,我有一個certbot autorenew失敗。用於續訂證書的cron腳本失敗,並且證書過期。下面是日誌,其中包括在最後我ssh'ing到框中手動運行certbot-auto renew --standalone --no-self-upgrade命令來解決問題。Certbot autorenew失敗

我的問題是 - 這確實顯示了證書更新錯誤的根源?它與今天的GitHub中斷有關嗎,還是另一個問題?我可以做些什麼來避免這種情況呢?

這是一個運行更新腳本cron作業(LE-renew.log是下面的日誌文件的名稱):

30 2 * * 1 /usr/local/sbin/certbot-auto renew >> /var/log/le-renew.log 

LE-renew.log:

...(more duplicate logfile entries above) 
Get:21 http://http.debian.net jessie/main Sources [7,054 kB] 
Err http://ppa.launchpad.net jessie/main amd64 Packages 
    404 Not Found 
Ign http://ppa.launchpad.net jessie/main Translation-en_US 
Ign http://ppa.launchpad.net jessie/main Translation-en 
Get:22 http://http.debian.net jessie/main amd64 Packages [6,789 kB] 
Get:23 http://http.debian.net jessie/main Translation-en [4,582 kB] 
Fetched 1,083 kB in 9s (113 kB/s) 
apt-get update hit problems but continuing anyway... 
Reading package lists... 
Building dependency tree... 
Reading state information... 
augeas-lenses is already the newest version. 
libaugeas0 is already the newest version. 
gcc is already the newest version. 
libffi-dev is already the newest version. 
libssl-dev is already the newest version. 
openssl is already the newest version. 
python is already the newest version. 
python-dev is already the newest version. 
python-virtualenv is already the newest version. 
virtualenv is already the newest version. 
The following packages will be upgraded: 
    ca-certificates 
1 upgraded, 0 newly installed, 0 to remove and 83 not upgraded. 
Need to get 207 kB of archives. 
After this operation, 92.2 kB disk space will be freed. 
Do you want to continue? [Y/n] Abort. 
Bootstrapping dependencies for Debian-based OSes... (you can skip this with --no-bootstrap) 
Ign http://http.debian.net jessie InRelease 
Hit https://deb.nodesource.com jessie InRelease 
Get:1 http://security.debian.org jessie/updates InRelease [63.1 kB] 
Get:2 http://http.debian.net jessie-updates InRelease [145 kB] 
Hit http://http.debian.net jessie Release.gpg 
Hit http://http.debian.net jessie Release 
Get:3 https://deb.nodesource.com jessie/main Sources [762 B] 
Get:4 http://http.debian.net jessie-updates/main Sources [15.7 kB] 
Get:5 https://deb.nodesource.com jessie/main amd64 Packages [966 B] 
Get:6 https://deb.nodesource.com jessie/main Translation-en_US [162 B] 
Get:7 https://deb.nodesource.com jessie/main Translation-en [162 B] 
Get:8 http://http.debian.net jessie-updates/main amd64 Packages/DiffIndex [8,392 B] 
Get:9 http://http.debian.net jessie-updates/main Translation-en/DiffIndex [3,196 B] 
Get:10 https://deb.nodesource.com jessie/main Translation-en_US [162 B] 
Get:11 https://deb.nodesource.com jessie/main Translation-en [162 B] 
Get:12 https://deb.nodesource.com jessie/main Translation-en_US [162 B] 
Hit http://security.debian.org jessie/updates/main Sources 
Hit http://security.debian.org jessie/updates/main amd64 Packages 
Get:13 https://deb.nodesource.com jessie/main Translation-en [162 B] 
Get:14 https://deb.nodesource.com jessie/main Translation-en_US [162 B] 
Hit http://security.debian.org jessie/updates/main Translation-en 
Get:15 https://deb.nodesource.com jessie/main Translation-en [162 B] 
Get:16 https://deb.nodesource.com jessie/main Translation-en_US [162 B] 
Ign https://deb.nodesource.com jessie/main Translation-en_US 
Get:17 https://deb.nodesource.com jessie/main Translation-en [162 B] 
Ign https://deb.nodesource.com jessie/main Translation-en 
Get:18 http://http.debian.net jessie/main Sources [7,054 kB] 
Get:19 http://http.debian.net jessie/main amd64 Packages [6,789 kB] 
Get:20 http://http.debian.net jessie/main Translation-en [4,582 kB] 
Ign http://ppa.launchpad.net jessie InRelease 
Ign http://ppa.launchpad.net jessie Release.gpg 
Ign http://ppa.launchpad.net jessie Release 
Err http://ppa.launchpad.net jessie/main amd64 Packages 
    404 Not Found 
Ign http://ppa.launchpad.net jessie/main Translation-en_US 
Ign http://ppa.launchpad.net jessie/main Translation-en 
Fetched 221 kB in 9s (23.8 kB/s) 
apt-get update hit problems but continuing anyway... 
Reading package lists... 
Building dependency tree... 
Reading state information... 
augeas-lenses is already the newest version. 
libaugeas0 is already the newest version. 
gcc is already the newest version. 
libffi-dev is already the newest version. 
libssl-dev is already the newest version. 
openssl is already the newest version. 
python is already the newest version. 
python-dev is already the newest version. 
python-virtualenv is already the newest version. 
virtualenv is already the newest version. 
The following packages will be upgraded: 
    ca-certificates 
1 upgraded, 0 newly installed, 0 to remove and 70 not upgraded. 
Need to get 207 kB of archives. 
After this operation, 92.2 kB disk space will be freed. 
Do you want to continue? [Y/n] Abort. 
Upgrading certbot-auto 0.13.0 to 0.16.0... 
Replacing certbot-auto... 
Creating virtual environment... 
Installing Python packages... 
Installation succeeded. 

------------------------------------------------------------------------------- 
Processing /etc/letsencrypt/renewal/example.com.conf 
------------------------------------------------------------------------------- 

------------------------------------------------------------------------------- 
new certificate deployed without reload, fullchain is 
/etc/letsencrypt/live/example.com/fullchain.pem 
------------------------------------------------------------------------------- 

Congratulations, all renewals succeeded. The following certs have been renewed: 
    /etc/letsencrypt/live/example.com/fullchain.pem (success) 
+0

你的日誌顯示沒有certbot失敗,只是容易日誌。 – captncraig

+0

@captncraig這就是我的想法 - 但更新肯定失敗。我在哪裏可以找到正確的日誌?或者是404日誌中的罪魁禍首? – YPCrumble

+0

https://askubuntu.com/a/56811/342069可以幫助找到的cron輸出 – captncraig

回答

2

的跳轉出來給我最重要的事情是,你在這裏的操作問題:

今天我不得不a certbot autorenew failure。用於續訂 證書的cron腳本失敗,和我的證書到期

你爲什麼要等到最後一天可能續約?您可以每天運行certbot,並且它會續約在未來30天內過期的任何事情。這應該會給你更多的時間來診斷和應對單次發行失敗。

你也應該監控爲失敗的cron作業。無論是通過外部服務,還是通過某種方式通知cron作業失敗。也許試試here的答案。

+0

有趣 - 我的cron作業_does_運行每星期一 - 我已經更新了我的問題,包括cron任務,它運行的腳本。我原以爲這隻會在有效期內續約,但如果您的評論是正確的,那麼續約在過去30天似乎每個星期一都會失敗...... – YPCrumble

+0

然後您也有一個監控問題。我個人只運行[caddy](https://caddyserver.com),它自動管理證書和續訂。 – captncraig