cerbot-nginx 插件在letencrypt 续约renew证书失败的一些记录
https://li5jun.com/article/512.html
时间：2018-08-29 21:58:36
下面是用letsencrypt续域名证书遇到的一些问题：
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Failed to find executable apache2ctl in PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/maven/bin:/home/jdk/bin
How would you like to authenticate with the ACME CA?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Spin up a temporary webserver (standalone)
2: Place files in webroot directory (webroot)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): c
Could not choose appropriate plugin: authenticator could not be determined or is not installed
authenticator could not be determined or is not installed
通过网上的解释，知道需要加一个参数--nginx，这样就不会去找apactl这种bin文件了。但是又出现了新的问题：
root@iZ28yczj108Z:~# /home/certbot/certbot-auto certonly --nginx --renew-by-default --email [email protected] -d li5jun.com -d www.li5jun.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Could not choose appropriate plugin: The nginx plugin is not working; there may be problems with your existing configuration.
The error was: NoInstallationError()
The nginx plugin is not working; there may be problems with your existing configuration.
The error was: NoInstallationError()
见名知意，需要安装一个nginx插件，在网上找到，需要的是certbot的插件，用python安装
pip install certbot-nginx
因为我用的是debian7，这个命令执行后，会出现许多的安装输出，安静的等待，做一个安静的小公举。
Downloading https://files.pythonhosted.org/packages/ea/cd/35485615f45f30a510576f1a56d1e0a7ad7bd8ab5ed7cdc600ef7cd06222/asn1crypto-0.24.0-py2.py3-none-any.whl (101kB)
41% |█████████████▍ | 880kB 30kB/s eta 0:00:41
最后还输出了这么一行文字：
You are using pip version 9.0.1, however version 18.0 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
执行命令后，还是说plugin没有安装。
下面要去一个地方改一下 /etc/letsencrypt/renewal ,把下面的authenticator和installer改掉，改成nginx
# Options used in the renewal process
[renewalparams]
authenticator = standalone [nginx]
installer = None [nginx]
account = 512ba1f8b16a6666ccb70786c9bc8125
运行测试命令，结果还是报错：
/home/certbot/certbot-auto --dry-run renew
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing /etc/letsencrypt/renewal/li5jun.com.conf
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Cert not due for renewal, but simulating renewal for dry run
Could not choose appropriate plugin: The nginx plugin is not working; there may be problems with your existing configuration.
The error was: NoInstallationError()
Attempting to renew cert (li5jun.com) from /etc/letsencrypt/renewal/li5jun.com.conf produced an unexpected error: The nginx plugin is not working; there may be problems with your existing configuration.
The error was: NoInstallationError(). Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/li5jun.com/fullchain.pem (failure)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates below have not been saved.)
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/li5jun.com/fullchain.pem (failure)
** DRY RUN: simulating 'certbot renew' close to cert expiry
** (The test certificates above have not been saved.)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1 renew failure(s), 0 parse failure(s)
最后在github上找到这个issue的答案，原来是，手动从源文件编译nginx的时候，没有把路径加到环境变量中，导致cerbot找不到nginx。这个用which nginx可以测试出来。
添加环境变量后注意，conf配置文件也要建立一个软连接：
ln -s /usr/local/nginx/conf/ /etc/nginx
箭：https://github.com/certbot/certbot/issues/4937
成功后的输出如下：
/home/certbot/certbot-auto certonly --nginx --renew-by-default --email [email protected] -d li5jun.com -d www.li5jun.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for li5jun.com
tls-sni-01 challenge for www.li5jun.com
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/li5jun.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/li5jun.com/privkey.pem
Your cert will expire on 2018-11-27. To obtain a new or tweaked
version of this certificate in the future, simply run certbot-auto
again. To non-interactively renew *all* of your certificates, run
"certbot-auto renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le