ACME cert update confusion

[chudak]

Hello

I am a bit confused. I use ACME with dynu DNS challenge and when ordering new certificate via WebGUI all works fine.
However the command line from crontab

"/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh

fails as:

[Fri 16 Jul 2021 11:54:31 AM PDT] Getting Dynu token.
[Fri 16 Jul 2021 11:54:32 AM PDT] Authentication failed.
[Fri 16 Jul 2021 11:54:32 AM PDT] Can not get token.
[Fri 16 Jul 2021 11:54:32 AM PDT] Getting https://api.dynu.com/v2/dns/getroot/connections.dynu.net
[Fri 16 Jul 2021 11:54:32 AM PDT] Getting https://api.dynu.com/v2/dns/getroot/dynu.net
[Fri 16 Jul 2021 11:54:32 AM PDT] Getting https://api.dynu.com/v2/dns/getroot/net
[Fri 16 Jul 2021 11:54:33 AM PDT] Invalid domain.
[Fri 16 Jul 2021 11:54:33 AM PDT] Error add txt for domain:_acme-challenge.connections.dynu.net
[Fri 16 Jul 2021 11:54:33 AM PDT] Please add '--debug' or '--log' to check more details.
[Fri 16 Jul 2021 11:54:33 AM PDT] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
[Fri 16 Jul 2021 11:54:33 AM PDT] Error renew XXX.dynu.YYY.

Why?

And PBS ACME related question - we don't have a crontab line for it ?

Thx

 

[Stoiko Ivanov]

I am a bit confused. I use ACME with dynu DNS challenge and when ordering new certificate via WebGUI all works fine.
However the command line from crontab

All Proxmox products (PVE, PBS and PMG) use their own acme-implementation (they do use the dns-plugins of acme.sh, but they are called by the pve-tools not by acme.sh)

the crontab is most likely a leftover from a manual install of acme.sh you did?
I'd suggest to remove the cronentry - if everything works fine via GUI

I hope this helps!

 

[chudak]

All Proxmox products (PVE, PBS and PMG) use their own acme-implementation (they do use the dns-plugins of acme.sh, but they are called by the pve-tools not by acme.sh)

the crontab is most likely a leftover from a manual install of acme.sh you did?
I'd suggest to remove the cronentry - if everything works fine via GUI

I hope this helps!

IIRC I did not install ACME it was standard proxmox

How then proxmox does automatic certificates updates ?

 

[Stoiko Ivanov]

How then proxmox does automatic certificates updates ?

depending on the product - for Proxmox VE it's pve-daily-update.service (invoked by pve-daily-update.timer) , for PMG it's pmg-daily.timer
for PBS proxmox-backup-daily-update.timer.

 

[chudak]

depending on the product - for Proxmox VE it's pve-daily-update.service (invoked by pve-daily-update.timer) , for PMG it's pmg-daily.timer
for PBS proxmox-backup-daily-update.timer.

That's interesting, thank you !

I removed the line:

0 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

Is there a way to test what you described in the term ?

 

[Stoiko Ivanov]

Is there a way to test what you described in the term ?

Again this depends on the product - I'll assume you're speaking about PVE (due to the forum):
` pvenode acme cert renew -force`
should do the trick

see the man-page of pvenode

I hope this helps!

 

[chudak]

Again this depends on the product - I'll assume you're speaking about PVE (due to the forum):
` pvenode acme cert renew -force`
should do the trick

see the man-page of pvenode

I hope this helps!

Great !

I looked at systemctl status pve-daily-update and see no line for ACME
Is it normal ?

 

[Stoiko Ivanov]

I looked at systemctl status pve-daily-update and see no line for ACME

yes - it's in the pveupdate executable called by pve-daily-update - see:

https://git.proxmox.com/?p=pve-mana...989873707cd874901dfa8699251d846cd;hb=HEAD#l79

 

[chudak]

yes - it's in the pveupdate executable called by pve-daily-update - see:

https://git.proxmox.com/?p=pve-mana...989873707cd874901dfa8699251d846cd;hb=HEAD#l79

cool!

is it possible to get emails on when it was invoked (similar like from crontab) ?

 

[Stoiko Ivanov]

is it possible to get emails on when it was invoked (similar like from crontab) ?

no - not directly - it's a systemd-timer - check the docs
https://www.freedesktop.org/software/systemd/man/systemd.timer.html

however if the service has any problem you'll see it in the task-log (on the GUI in the bottom) of the node/cluster

maybe the article in the arch-wiki is helpful:
https://wiki.archlinux.org/title/Systemd/Timers#MAILTO

I hope this helps!

 

[chudak]

no - not directly - it's a systemd-timer - check the docs
https://www.freedesktop.org/software/systemd/man/systemd.timer.html

however if the service has any problem you'll see it in the task-log (on the GUI in the bottom) of the node/cluster

maybe the article in the arch-wiki is helpful:
https://wiki.archlinux.org/title/Systemd/Timers#MAILTO

I hope this helps!

@Stoiko Ivanov thank you !

 

[chudak]

however if the service has any problem you'll see it in the task-log (on the GUI in the bottom) of the node…

@Stoiko Ivanov as a suggestion, if it’s possible to show those service lines in the task-log not only on error but alway, or better yet to make ir configurable so users can choose.

thx