Does acme.sh remember how I deployed certificates when it renews them?
reddit / selfhosted

----------------------------------------------------------------------
Skyronman · 2023-11-30 12:13

I don't relly know how acme.sh works internally so that's why I'm
unsure as to how it'll renew my certificates, thus I have those four
questions.

* Does it remember the command I used to deploy the certificates and
will it use that again when it renews them? (some env vars set using
export are required)
* Also for a certificate to be renewed automatically I just need to
issue and deploy it once and make sure I have the cronjob installed
right?
* I use DNS to sign a wildcard certificate and for now I always set
the API token using an env var. Does renewal work out of the box like
this, if not where can I specify the API token?
* If I have a certificate created by another instance of amce.sh how
can I also make that it'll get renewed automatically?

Thanks for your answers!

----------------------------------------------------------------------
American_Jesus · 2023-11-30 13:13

You should have your domain configurations at ~/.acme.sh/

----------------------------------------------------------------------
lilolalu · 2023-11-30 15:26

Yeah, and there you can add / remove domains, change deployment hooks
etc.

----------------------------------------------------------------------
sinclairks · 2023-12-01 04:36

1. Did you use any of the "--install-cert" (etc) or "--reloadCmd"
options when initially deploying the cert? If not, then it won't do
any of that automatically. Look into those two if you want to do
something beyond just renewing the cert, for example copying it
somewhere else, reloading a web server, etc.

    2. Yep, long as it has a cron entry, it will renew automatically
based on your original commands (see above).

    3. DNS settings should be in your data/account.conf file. These
will be based on which DNS server you are using, see the docs for
details.

    4. Another instance on the same machine? You should only need one
for all your certs on a specific machine, unless you have some non-
standard config.

----------------------------------------------------------------------
sinclairks · 2023-12-01 04:36

1. Did you use any of the "--install-cert" (etc) or "--reloadCmd"
options when initially deploying the cert? If not, then it won't do
any of that automatically. Look into those two if you want to do
something beyond just renewing the cert, for example copying it
somewhere else, reloading a web server, etc.
2. Yep, long as it has a cron entry, it will renew automatically based
on your original commands (see above).
3. DNS settings should be in your data/account.conf file. These will
be based on which DNS server you are using, see the docs for details.
4. Another instance on the same machine? You should only need one for
all your certs on a specific machine, unless you have some non-
standard config.

----------------------------------------------------------------------
Skyronman · 2023-12-01 06:55

Those are the commands I used to create and deploy the certs:
\- `acme.sh` `--issue --dns dns_ -d` `domain.com`

\- `acme.sh` `--deploy --deploy-hook haproxy -d` `domain.com`

So If I understood it correctly the second command wont be remembered?
Now that I have all the certs already how can I add the automatic
deploys for the next renewal? This also relates to point 4. I had some
certs already signed on the same VM which I had to reset and I want to
add them to be automatically renewed.