☰

如何排除 Ubuntu Certbot cron/timer 故障？

tag-icon • tag-icon ubuntu cron systemd certbot systemd-timers
如何排除 Ubuntu Certbot cron/timer 故障？ 
lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.2 LTS
Release:        20.04
Codename:       focal

并通过 apt-get 安装了 certbot

我的问题是，这是证书第二次过期，并且 certbot 安装的 cron（也是 systemd 服务）不起作用。

我看到这个文件被创建：

/lib/systemd/system/certbot.timer

[Unit]
Description=Run certbot twice daily

[Timer]
OnCalendar=*-*-* 00,12:00:00
RandomizedDelaySec=43200
Persistent=true

[Install]
WantedBy=timers.target

/lib/systemd/system/certbot.service

[Unit]
Description=Certbot
Documentation=file:///usr/share/doc/python-certbot-doc/html/index.html
Documentation=https://letsencrypt.readthedocs.io/en/latest/
[Service]
Type=oneshot
ExecStart=/usr/bin/certbot -q renew
PrivateTmp=true

/etc/cron.d/certbot

# /etc/cron.d/certbot: crontab entries for the certbot package
#
# Upstream recommends attempting renewal twice a day
#
# Eventually, this will be an opportunity to validate certificates
# haven't been revoked, etc.  Renewal will only occur if expiration
# is within 30 days.
#
# Important Note!  This cronjob will NOT be executed if you are
# running systemd as your init system.  If you are running systemd,
# the cronjob.timer function takes precedence over this cronjob.  For
# more details, see the systemd.timer manpage, or use systemctl show
# certbot.timer.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew

我的初始化系统是systemctl：

[[ `systemctl` =~ -\.mount ]] && echo yes || echo no
yes

我看到那里注册了计时器：

 systemctl list-timers | grep 'cert'
Fri 2022-03-25 17:36:31 UTC 6h left        Fri 2022-03-25 02:41:57 UTC 8h ago       certbot.timer                certbot.service

我还尝试检查计时器调用，以查看 certbot 计时器是否在前一天午夜被调用：

journalctl  --since "2 days ago" -u motd-news.timer 
-- Logs begin at Sun 2021-09-26 19:26:36 UTC, end at Fri 2022-03-25 11:37:03 UTC. --
Mar 25 09:54:16 ip-10-40-2-7 systemd[1]: motd-news.timer: Succeeded.
Mar 25 09:54:16 ip-10-40-2-7 systemd[1]: Stopped Message of the Day.
-- Reboot --
Mar 25 09:54:55 ip-10-40-2-7 systemd[1]: Started Message of the Day.
-- Reboot --
Mar 25 09:59:11 ip-10-40-2-7 systemd[1]: Started Message of the Day.
Mar 25 10:06:38 ip-10-40-2-7 systemd[1]: motd-news.timer: Succeeded.
Mar 25 10:06:38 ip-10-40-2-7 systemd[1]: Stopped Message of the Day.
-- Reboot --
Mar 25 10:08:45 ip-10-40-2-7 systemd[1]: Started Message of the Day.

我不明白为什么 certbot renew 命令这个 cron/timer 从未被调用或者被调用但出现故障（为此我需要信息来检查日志）。

答案1

这对我有用

您的系统不使用 cron，因此请忽略它，它是 systemd。

certbot.计时器：

[Unit]
Description=Timer for Certbot Renewal

[Timer]
OnBootSec=300
OnUnitActiveSec=1d

[Install]
WantedBy=timers.target

certbot.服务：

[Unit]
Description=Let's Encrypt renewal
Wants=network.target
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/bin/certbot renew --quiet --agree-tos
ExecStartPost=/bin/systemctl reload nginx.service
ExecStartPost=/bin/systemctl reload postfix.service
ExecStartPost=/bin/systemctl reload dovecot.service

我还看到你重启了几次电脑，但你也在看motd-news.timer。所以你不会看到有关 certbot 计时器的任何信息！

相关内容