Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Last time updated?

    Scheduled Pinned Locked Moved ACME
    34 Posts 3 Posters 3.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GertjanG
      Gertjan
      last edited by Gertjan

      Didn't had a look myself yet .... but it's there : exactly at 03h16 minutes sharp :

      2019-01-25 03:15:54	Cron.Info	192.168.1.1	Jan 25 03:16:00 /usr/sbin/cron[87247]: (root) CMD (/usr/local/pkg/acme/acme_command.sh "renewall" | /usr/bin/logger -t ACME 2>&1)
      2019-01-25 03:15:55	User.Notice	192.168.1.1	Jan 25 03:16:00 ACME: Checking if renewal is needed for: V2_brit-hotel-fumel.net
      2019-01-25 03:15:55	User.Notice	192.168.1.1	Jan 25 03:16:00 ACME: Renewal number of days not yet reached.
      

      Btw : using an external syslogger.

      edit : grepping using the magic word ( = ACME) nailed it in a split second.

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      1 Reply Last reply Reply Quote 1
      • chudakC
        chudak @chudak
        last edited by

        @jimp

        Just wondering when I see in logs those entries ("Renewal number of days not yet reached"), can I assume that NAT/FW rule for port forwarding was used and worked successfully?

        1 Reply Last reply Reply Quote 0
        • jimpJ
          jimp Rebel Alliance Developer Netgate
          last edited by

          No, that is only a local check of the certificate expiration date

          Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          chudakC 1 Reply Last reply Reply Quote 0
          • chudakC
            chudak @jimp
            last edited by

            @jimp

            so how to enforce real check ? Renew via UI ?

            1 Reply Last reply Reply Quote 0
            • jimpJ
              jimp Rebel Alliance Developer Netgate
              last edited by

              You can force it via the UI but that won't test your schedule since it's time-based.

              There isn't an easy way to test that until it runs again naturally.

              You could edit the cron job, add -force to the acme script call parameters, then wait overnight for the schedule to trigger, but that's not ideal either.

              Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              chudakC 1 Reply Last reply Reply Quote 0
              • chudakC
                chudak @jimp
                last edited by

                @jimp

                What if I lift schedule temporarily and run in command line:

                /usr/local/pkg/acme/acme_command.sh "renewall" --force
                
                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  Just one dash -force.

                  If you disable the schedule so the rule is always active, then it should work to test just the renew, but that still doesn't help you test the schedule or the cron job.

                  Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  chudakC 1 Reply Last reply Reply Quote 0
                  • chudakC
                    chudak @jimp
                    last edited by

                    @jimp I realize this. My goal to test an odd port fowarding and it did seem to work.

                    "Reload success" is this sufficient ?

                    1 Reply Last reply Reply Quote 0
                    • jimpJ
                      jimp Rebel Alliance Developer Netgate
                      last edited by

                      If you see the cert in the list with an updated valid/expiration date, then yeah.

                      Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      chudakC 1 Reply Last reply Reply Quote 0
                      • chudakC
                        chudak @jimp
                        last edited by chudak

                        @jimp

                        Everything looks great and worked as expected.

                        The only minor note

                        I ran as:

                        /usr/local/pkg/acme/acme_command.sh "renewall" -force | /usr/bin/logger -t ACME 2 > & 1
                        
                        Array
                        (
                            [path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
                            [PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
                            [port] => XYZ
                            [ipv6] => 
                        )
                        ...
                        [Wed Jan 30 10:11:14 PST 2019] Cert success.
                        

                        However when I filtered FW log for XYZ Destination Port I found nothing.

                        Odd...

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @chudak
                          last edited by

                          @chudak said in Last time updated?:

                          However when I filtered FW log for XYZ Destination Port I found nothing.

                          Same thing for me.
                          I searched for "Magic Cake" and I didn't find nothing aether.
                          But I wasn't surprised ....
                          A firewall logs if you instructed it to log.

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          chudakC 1 Reply Last reply Reply Quote 0
                          • chudakC
                            chudak @Gertjan
                            last edited by

                            @gertjan said in Last time updated?:

                            @chudak said in Last time updated?:
                            Cake" and I didn't find nothing aether.
                            But I wasn't surprised ....
                            A firewall logs if you instructed it to log.

                            what do you mean ? why ?

                            I do have BTW traffic logging enabled for the FW rule.

                            1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan
                              last edited by Gertjan

                              In that case, it the LE server comes in to check, the firewall rule that logs should log something.

                              Another side effect : your cert was renewed - just check the dates of the cert.
                              Btw : don't do this to often : 5 times in a week and your renewal will be blocked.

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              chudakC 1 Reply Last reply Reply Quote 0
                              • chudakC
                                chudak @Gertjan
                                last edited by

                                @gertjan said in Last time updated?:

                                In that case, it the LE server comes in to check, the firewall rule that logs should log something.

                                Another side effect : your cert was renewed - just check the dates of the cert.
                                Btw : don't do this to often : 5 times in a week and your renewal will be blocked.

                                Everything worked perfectly, CA renewed.

                                No log entry in FW logs, that's all
                                I thought I saw a commit about Acme and FW logs, but can't find it now... Maybe mistaken

                                GertjanG 1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @chudak
                                  last edited by

                                  @chudak said in Last time updated?:

                                  Everything worked perfectly, CA renewed.

                                  So you're good !

                                  The acme package is not related to the firewall (rules) what so ever. That's up to you.

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.