Renew Letsencrypt Certificate on Nextcloud Box

Hi,

I have got an expiration email. How can i renew the Letsencrypt Certificate on my Nextcloud Box ?

Connect to it with SSH then lunch this command in a sudo or root user :

letsencrypt renew

It will be okay normally.
You can use a cron command for not being late :

    • */1 * * letsencrypt renew

On the nextcloud box is Snappy Ubuntu Core running and there is no “letsencrypt” in /usr/bin/

nextcloud.enable-https -h shows

Run without any arguments this script will obtain a certificate from Let's Encrypt and automatically keep it up to date.

So in my opinion, the renewal of the cerificate will start automaticaly. Is this right?

@Nemskiller
how to set time to sync?
means how to set it to do after 90 days or like that?
or will it check daily?

It depends on what you enter in your crontab.

The command (not for nextcloud box) is letsencrypt renew

You can do it every day or everyweek, it’s not a problem letsencrypt will say :
No certificate to renew or Renewing certificate near expirying

Look how to use crontab

But what is the right way for the box? Will it work automaticaly or not?

Hi i also have the problem that auto renew seems not to work (don´t know where to check) and that letsencrypt renew command is not supported!

Any help on this?

Yes, the auto renew seems not to work, because i got a new mail today from the Let’s Encrypt Team

“Your certificate (or certificates) for the names listed below will expire in 9 days (on 13 Jan 17 13:13 +0000). Please make sure to renew your certificate before then, or visitors to your website will encounter errors.”

What can the nextbox users do ? Is this a bug or a feature ? :frowning:

I would also like to know how the lets encrypt certificate will be renewed on Nextcloud Box, and when it will be renewed?

Couldn’t find anything from crontab or /etc/cron* which would keep it renewed.

pete

There was a bug. After updating to the newest version of the snap certificate renewal works for me.

There is a service which deals with the certificate renewal (snap.nextcloud.renew-certs.service). So normally the renewal is handled automatically.

Jörg

Can you please describe how you did it?
Thx!
sky

Normaly this will proceed automatically. If not you can trigger it with sudo snap refresh.

After updating to the newest version of the snap certificate renewal works for me.

I have the latest snap version running on my box. However, I also received the email from letsencrypt and the certificate expired yesterday. Re-running sudo nextcloud.enable-https produces

Attempting to obtain certificates... done
ERROR: ld.so: object '/usr/lib/arm-linux-gnueabihf/libarmmem.so' from /etc/ld.so.preload cannot be preloaded (ERROR: ld.so: object '/usr/lib/arm-linux-gnueabihf/libarmmem.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
cannot open shared object file): ignored.
ERROR: ld.so: object '/usr/lib/arm-linux-gnueabihf/libarmmem.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object '/usr/lib/arm-linux-gnueabihf/libarmmem.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object '/usr/lib/arm-linux-gnueabihf/libarmmem.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object '/usr/lib/arm-linux-gnueabihf/libarmmem.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
Restarting apache... ERROR: ld.so: object '/usr/lib/arm-linux-gnueabihf/libarmmem.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object '/usr/lib/arm-linux-gnueabihf/libarmmem.so' from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
done

and does not seem to work. Do I need to get rid of the old certificate first?

Hi,

My snaps are all updated.

$ snap list
    Name         Version      Rev   Developer  Notes
    nextcloud    11.0.1snap1  719   nextcloud  -
    ubuntu-core  16.04.1      1361  canonical  -
$ sudo snap refresh
All snaps up to date.

The mentioned renew-certs service seems to be running:

$ ps ax | grep certs
10703 ?        Ss     0:00 /bin/sh /snap/nextcloud/719/bin/renew-certs

Yet my letsencrypt cert is about to expire tomorrow.

Same with me, although this is because I thought that these Lets Encypt Certificate Expiration reminder emails didnt need me to do anything (just my stupidity, I dont want to cloud the current issue with an explanation of exactly why :slight_smile: ) and my certificate expired (which I wouldn’t have known how to do anyway).

Not knowing how to resurrect the certificate I tried to follow the instructions in part 4 here in the wiki again but ran into problems

sudo nextcloud.enable-https -d

worked OK:

Looks like you’re ready for HTTPS!

But

sudo nextcloud.enable-https

gave me repeated errors:

Attempting to obtain certificates… done
ERROR: ld.so: object ‘/usr/lib/arm-linux-gnueabihf/libarmmem.so’ from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object ‘/usr/lib/arm-linux-gnueabihf/libarmmem.so’ from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object ‘/usr/lib/arm-linux-gnueabihf/libarmmem.so’ from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object ‘/usr/lib/arm-linux-gnueabihf/libarmmem.so’ from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object ‘/usr/lib/arm-linux-gnueabihf/libarmmem.so’ from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
ERROR: ld.so: object ‘/usr/lib/arm-linux-gnueabihf/libarmmem.so’ from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
Restarting apache… ERROR: ld.so: object ‘/usr/lib/arm-linux-gnueabihf/libarmmem.so’ from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored.
done

Afterwards, I tried deleting the existing trusted certificates lines (except for the 0 line one) in my config.php file and then trying again, but this just gave me the same errors

So, now when I try to access the box it says my certificates are not correct

Can someone help me, please?

Please check wether the certificate was renewed or installed. I got similar messages, but the certificate was renewed/installed. You can check it with your browser,

Jörg

I have the exact same problem. Certificate is about to expire and i couldn’t find a way to renew it…

Actually deleting the old certificate folders (or moving them to a backup folder) before creating new ones worked for me. I think the path was something like /var/snap/nextcloud/current/certs.

I also noticed that I had to re-generate the certificates when the snap was updated.

In the worst case, running nextcloud with a self-signed certificate should work.

Thanks Oli!

That worked :smiley:

For others like me, what I did exactly was:

cd /var/snap/nextcloud/current/
mv certs certs1

reboot

nextcloud.enable-https lets-encrypt -d

and after that said that I was ready

nextcloud.enable-https lets-encrypt
rm -r certs1

I used nextcloud.enable-https -h to work out that the info in the wiki doesn’t tell you to put in the lets-encrypt option.
Is this new? I think I only used nextcloud.enable-https -d before, but that doesn’t work (Although I could well have just not remembered putting in lets-encrypt)

How do I know when the snap has been updated?