Solved acme.sh cron certificate reissue

bagas · Dec 7, 2023

Hello.
Install soft acme.

# acme.sh -v

GitHub - acmesh-official/acme.sh: A pure Unix shell script implementing ACME client protocol

A pure Unix shell script implementing ACME client protocol - acmesh-official/acme.sh

github.com

v3.0.7

For security reasons, from the user acme has shell removed (/usr/sbin/nologin).

# grep acme /etc/master.passwd
acme:*:169:169::0:0:ACME protocol client:/var/db/acme:/usr/sbin/nologin

How to re-issue a certificate correctly?
I do this.

# su -m acme /usr/local/sbin/acme.sh --cron --home "/var/db/acme/.acme.sh" > /dev/null
VER=3.0.7: Command not found.
PROJECT_NAME=acme.sh: Command not found.
PROJECT_ENTRY=acme.sh: Command not found.
PROJECT_NAME: Undefined variable.

# ls -al /var/db/acme/.acme.sh
total 24
drwxr-x--- 3 acme acme 512 12 нояб. 17:33 .
drwxr-x--- 7 acme acme 512 6 дек. 18:44 ..
-rw-r----- 1 acme acme 274 6 дек. 00:25 account.conf
-rw-r----- 1 acme acme 184 12 нояб. 17:33 account.conf.sample
drwxr-xr-x 4 acme acme 512 14 окт. 2022 ca
lrwxr-xr-x 1 root wheel 51 12 нояб. 17:33 deploy -> ../../../../usr/local/share/examples/acme.sh/deploy
lrwxr-xr-x 1 root wheel 51 12 нояб. 17:33 dnsapi -> ../../../../usr/local/share/examples/acme.sh/dnsapi
-rw-r--r-- 1 acme acme 494 6 дек. 00:25 http.header
lrwxr-xr-x 1 root wheel 51 12 нояб. 17:33 notify -> ../../../../usr/local/share/examples/acme.sh/notify

# ls -al /var/db/acme/
total 32
drwxr-x--- 7 acme acme 512 6 дек. 18:44 .
drwxr-xr-x 17 root wheel 512 12 нояб. 19:01 ..
drwxr-x--- 3 acme acme 512 12 нояб. 17:33 .acme.sh
drwx------ 3 acme acme 512 12 окт. 2022 .cache
drwx------ 3 acme acme 512 12 окт. 2022 .config
drwx------ 3 acme acme 512 12 окт. 2022 .local
-rw-r--r-- 1 acme acme 0 6 дек. 00:25 .restart_nginx
-rw------- 1 acme acme 40 6 дек. 18:44 .sh_history
drwxr-x--- 3 acme acme 512 14 окт. 2022 certs

# id acme
uid=169(acme) gid=169(acme) groups=169(acme)

What am I doing wrong?

sko · Dec 7, 2023

bagas said:
For security reasons, from the user acme has shell removed (/usr/sbin/nologin).

why? that user can't login anyways (password is set to '*')

bagas said:
How to re-issue a certificate correctly?

give the acme user back a shell so it can run the shell script...

bagas · Dec 7, 2023

sko said:
give the acme user back a shell so it can run the shell script...

it's not safe!

bagas · Dec 7, 2023

su -m acme -c '/usr/local/sbin/acme.sh --cron --home "/var/db/acme/.acme.sh"'

I figured out the problem, it works.
Single quotes and forgot to specify the class -c