jamesseanwright / certbot-heroku-renewal

Automate the renewal of Certbot SSL certificates and their deployment to Heroku SSL

Certbot & Heroku SSL Renewal Script

A shell script to automate the renewal of Certbot SSL certificates and their deployment to Heroku SSL.

Usage

sudo ./renew.sh DOMAIN HEROKU_APP_NAME

• DOMAIN - the main domain name of the website you wish to renew. Can be found under /etc/letsencrypt/live
• HEROKU_APP_NAME the name of the Heroku app against which the SSL certificates will be updated

e.g. sudo ./renew.sh foobar.co.uk foo-bar-app

Due to the opinionated directory permissions required by Certbot, this script must be run as root.

Conditionally Toggling The ACME Challenge Endpoint

The Heroku app against which I call this script has an ACME Challenge endpoint that can be toggled with an environment variable. This is commented out to demonstrate how this can be configured via the Heroku CLI.

certbot-heroku-renewal's Issues

broken: renew requesting ACME-challenge with certbot 0.10.0

Automatic renews don't work for me anymore. certbot is apparently requesting a new ACME response.

I receive this issue when running renew.sh:

Attempting to renew cert from /etc/letsencrypt/renewal/XXX.conf produced an unexpected error: The manual plugin is not working; there may be problems with your existing configuration.
The error was: PluginError('An authentication script must be provided with --manual-auth-hook when using the manual plugin non-interactively.',). Skipping.

Regarding the issue about this it is now possible to include a hook into the manual auth process.

Quoting:

manual:
  Authenticate through manual configuration or custom shell scripts. When
  using shell scripts, an authenticator script must be provided. The
  environment variables available to this script are $CERTBOT_DOMAIN which
  contains the domain being authenticated, $CERTBOT_VALIDATION which is the
  validation string, and $CERTBOT_TOKEN which is the filename of the
  resource requested when performing an HTTP-01 challenge. An additional
  cleanup script can also be provided and can use the additional variable
  $CERTBOT_AUTH_OUTPUT which contains the stdout output from the auth
  script.

  --manual-auth-hook MANUAL_AUTH_HOOK
                        Path or command to execute for the authentication
                        script (default: None)
  --manual-cleanup-hook MANUAL_CLEANUP_HOOK
                        Path or command to execute for the cleanup script
                        (default: None)
  --manual-public-ip-logging-ok
                        Automatically allows public IP logging (default: Ask)