Last time updated?

jimp

Status > System Logs, search for ACME

chudak

I have Cron Entry enabled
I see in Cron UI

16	3	*	*	*	root	/usr/local/pkg/acme/acme_command.sh "renewall" | /usr/bin/logger -t ACME 2>&1

I have NAT/WF rule on schedule

Mon - Sun 3:15 3:30

I check via Status > System Logs > General and filter Message for ACME
... and I see no traces of ACME executed in time range

PS: Manually running ACME works fine

You see something wrong with these steps ?

jimp

When did you last update the ACME package? I just put out the update with the log entry for cron in the last couple days. If you updated today, for example, you'd have no log entries for it yet.

Also if your system log is especially busy, it may not go back far enough to show log entries from then.

chudak

@jimp

I am running ACME version 0.5.3.

Is it good ?

And cron says:

| /usr/bin/logger -t ACME 2>&1

and here see my log https://snag.gy/auomlf.jpg

Maybe it will show up tomorrow ?

jimp

It might, but like I said, if your log is very busy it may have scrolled off before you checked.

chudak

@jimp

that's an interesting point.

But if you look at my log as above, you see ALL entries for 1/25/19, don't you? Where would it be ?

Still consider show on the UI. I bet you majority of people would love that :)

jimp

The earliest it shows is 7:42 AM, the log entry would have been from 3:16 AM. It might have already fallen off the start of the circular log.

chudak

@jimp

how ?

next you see

Jan 25 07:40:03	php-fpm		/acme/acme_certificates_edit.php: Beginning configuration backup to .https://acb.netgate.com/save
Jan 24 20:44:33	php		/usr/local/pkg/acme/acme_command.sh: End of configuration backup to https://acb.netgate.com/save (success).

the day before yesterday, no ?

jimp

Ah, sorry, I hate reverse logs, my brain always sees top=oldest.

Try searching with ACME in the process field, not the message.

chudak

@jimp

That's it !

Jan 25 03:16:00	ACME		Renewal number of days not yet reached.
Jan 25 03:16:00	ACME		Checking if renewal is needed for: YYY
Jan 25 03:16:00	ACME		Renewal number of days not yet reached.
Jan 25 03:16:00	ACME		Checking if renewal is needed for: XXX

Thank you!

Still consider !!!

chudak

@jimp

I also wanted to mention that after being using ACME for several days I say that you deserved kudos and thank you's for maintaining its code ....

Gertjan

Didn't had a look myself yet .... but it's there : exactly at 03h16 minutes sharp :

2019-01-25 03:15:54	Cron.Info	192.168.1.1	Jan 25 03:16:00 /usr/sbin/cron[87247]: (root) CMD (/usr/local/pkg/acme/acme_command.sh "renewall" | /usr/bin/logger -t ACME 2>&1)
2019-01-25 03:15:55	User.Notice	192.168.1.1	Jan 25 03:16:00 ACME: Checking if renewal is needed for: V2_brit-hotel-fumel.net
2019-01-25 03:15:55	User.Notice	192.168.1.1	Jan 25 03:16:00 ACME: Renewal number of days not yet reached.

Btw : using an external syslogger.

edit : grepping using the magic word ( = ACME) nailed it in a split second.

chudak

@jimp

Just wondering when I see in logs those entries ("Renewal number of days not yet reached"), can I assume that NAT/FW rule for port forwarding was used and worked successfully?

jimp

No, that is only a local check of the certificate expiration date

chudak

@jimp

so how to enforce real check ? Renew via UI ?

jimp

You can force it via the UI but that won't test your schedule since it's time-based.

There isn't an easy way to test that until it runs again naturally.

You could edit the cron job, add -force to the acme script call parameters, then wait overnight for the schedule to trigger, but that's not ideal either.

chudak

@jimp

What if I lift schedule temporarily and run in command line:

/usr/local/pkg/acme/acme_command.sh "renewall" --force

jimp

Just one dash -force.

If you disable the schedule so the rule is always active, then it should work to test just the renew, but that still doesn't help you test the schedule or the cron job.

chudak

@jimp I realize this. My goal to test an odd port fowarding and it did seem to work.

"Reload success" is this sufficient ?

jimp

If you see the cert in the list with an updated valid/expiration date, then yeah.