cerbot-nginx 插件在letencrypt 续约renew证书失败的一些记录

https://li5jun.com/article/512.html

时间：2018-08-29 21:58:36

下面是用letsencrypt续域名证书遇到的一些问题：

 

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Failed to find executable apache2ctl in PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/maven/bin:/home/jdk/bin

 

How would you like to authenticate with the ACME CA?

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1: Spin up a temporary webserver (standalone)

2: Place files in webroot directory (webroot)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Select the appropriate number [1-2] then [enter] (press 'c' to cancel): c

Could not choose appropriate plugin: authenticator could not be determined or is not installed

authenticator could not be determined or is not installed

 

通过网上的解释，知道需要加一个参数--nginx，这样就不会去找apactl这种bin文件了。但是又出现了新的问题：

root@iZ28yczj108Z:~# /home/certbot/certbot-auto certonly --nginx --renew-by-default --email li5jun@126.com -d li5jun.com -d www.li5jun.com 

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Could not choose appropriate plugin: The nginx plugin is not working; there may be problems with your existing configuration.

The error was: NoInstallationError()

The nginx plugin is not working; there may be problems with your existing configuration.

The error was: NoInstallationError()

见名知意，需要安装一个nginx插件，在网上找到，需要的是certbot的插件，用python安装

 

pip install certbot-nginx     

 

 

 

因为我用的是debian7，这个命令执行后，会出现许多的安装输出，安静的等待，做一个安静的小公举。  

Downloading https://files.pythonhosted.org/packages/ea/cd/35485615f45f30a510576f1a56d1e0a7ad7bd8ab5ed7cdc600ef7cd06222/asn1crypto-0.24.0-py2.py3-none-any.whl (101kB)

 

    41% |█████████████▍                  | 880kB 30kB/s eta 0:00:41

最后还输出了这么一行文字：

 

You are using pip version 9.0.1, however version 18.0 is available.

You should consider upgrading via the 'pip install --upgrade pip' command.

执行命令后，还是说plugin没有安装。

 

下面要去一个地方改一下 /etc/letsencrypt/renewal ,把下面的authenticator和installer改掉，改成nginx

# Options used in the renewal process

[renewalparams]

authenticator = standalone [nginx]

installer = None [nginx]

account = 512ba1f8b16a6666ccb70786c9bc8125

 

运行测试命令，结果还是报错：

 

 /home/certbot/certbot-auto --dry-run renew

Saving debug log to /var/log/letsencrypt/letsencrypt.log

 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Processing /etc/letsencrypt/renewal/li5jun.com.conf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Cert not due for renewal, but simulating renewal for dry run

Could not choose appropriate plugin: The nginx plugin is not working; there may be problems with your existing configuration.

The error was: NoInstallationError()

Attempting to renew cert (li5jun.com) from /etc/letsencrypt/renewal/li5jun.com.conf produced an unexpected error: The nginx plugin is not working; there may be problems with your existing configuration.

The error was: NoInstallationError(). Skipping.

All renewal attempts failed. The following certs could not be renewed:

  /etc/letsencrypt/live/li5jun.com/fullchain.pem (failure)

 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

** DRY RUN: simulating 'certbot renew' close to cert expiry

**          (The test certificates below have not been saved.)

 

All renewal attempts failed. The following certs could not be renewed:

  /etc/letsencrypt/live/li5jun.com/fullchain.pem (failure)

** DRY RUN: simulating 'certbot renew' close to cert expiry

**          (The test certificates above have not been saved.)

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

1 renew failure(s), 0 parse failure(s)

最后在github上找到这个issue的答案，原来是，手动从源文件编译nginx的时候，没有把路径加到环境变量中，导致cerbot找不到nginx。这个用which nginx可以测试出来。

 

添加环境变量后注意，conf配置文件也要建立一个软连接：

ln -s /usr/local/nginx/conf/ /etc/nginx

箭：https://github.com/certbot/certbot/issues/4937 

成功后的输出如下：

/home/certbot/certbot-auto certonly --nginx --renew-by-default --email li5jun@126.com -d li5jun.com -d www.li5jun.com

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator nginx, Installer nginx

Renewing an existing certificate

Performing the following challenges:

tls-sni-01 challenge for li5jun.com

tls-sni-01 challenge for www.li5jun.com

Waiting for verification...

Cleaning up challenges

 

IMPORTANT NOTES:

 - Congratulations! Your certificate and chain have been saved at:

   /etc/letsencrypt/live/li5jun.com/fullchain.pem

   Your key file has been saved at:

   /etc/letsencrypt/live/li5jun.com/privkey.pem

   Your cert will expire on 2018-11-27. To obtain a new or tweaked

   version of this certificate in the future, simply run certbot-auto

   again. To non-interactively renew *all* of your certificates, run

   "certbot-auto renew"

 - If you like Certbot, please consider supporting our work by:

 

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate

   Donating to EFF:                    https://eff.org/donate-le