Never said immune. Said lower complexity surface. Your hook path changed because you didn't pin the package or read the release notes. I pin certbot at the major version, review apt upgrades quarterly. The systemd timer approach I use has a built-in random delay so all my nodes don't hammer LE at once, and I get email from unattended-upgrades on failure. Two boxes, TCP check, email. That's the whole system.
Member
Ah yes (the classic "just read the release notes" approach) (which works (in theory)) until you have 47 servers (with different OS versions (because migration is a myth)) and certbot 1.12 on some (and 2.0 on others (and one still on 0.40 (don't ask)))) and the release notes are (of course) different per branch (and sometimes wrong) (I found a bug in the Debian backports notes once) (filed it) (still open) (since 2022).
I now use acme.sh in Docker with DNS validation (Cloudflare API) and a single Prometheus exporter scraping expiry dates. One dashboard. 47 servers. The Docker is pinned by digest, not tag. It is absurd that this is the stable option, but here we are.
CloudCone only sells VPS, not certificates. Where does this $10 cert come from? I would not trust a certificate vendor I cannot verify. For my clients in Berlin I use Let's Encrypt with native certbot and a small Go binary I wrote that checks expiry and posts to a private Matrix room. Self-hosted monitoring, no third party with data access.
Namecheap, Sectigo PositiveSSL multi-year. CloudCone is my VPS host, not the CA. I mentioned them together because I bought both the same week. The cert is domain-validated, 2048-bit RSA, installs same as any other. No automation needed because it lasts two years. I set a calendar reminder at 18 months. Done.
LE is great if you enjoy being a sysadmin. I enjoy running my business.
I use acme.sh too but with the standalone mode on a dedicated tiny VM at Netcup. No web server to interfere, no nginx reload hooks to break. The VM runs nothing else, updates itself unattended, and rsyncs certs to the actual servers. Single point of failure? Yes. But a very simple one I understand.
Member
This was my exact symptom. Turned out certbot had created a temporary nginx config for HTTP-01 validation, my own redirect rule fought it, and both kept adding www. Back and forth. Fixed by switching to DNS-01 with acme.sh. No more nginx manipulation.
Member
Same. Certbot's nginx plugin is black magic that works until it doesn't. I now use
certbot certonly --manual-auth-hookFollowing this thread closely. Currently on LE with cron and no monitoring. Feeling seen.
What about Caddy? Handles HTTPS automatically, no cron, no certbot. I am considering switching my personal site.
Member OP
I looked at Caddy. The automatic HTTPS is appealing. But I need specific nginx configs for WooCommerce caching rules, rate limiting, and a bunch of location blocks that took me days to tune. Replicating that in Caddy's CEL-based matcher syntax is not trivial. Maybe for a new project. Migrating a live store? Different equation.
This is interesting. I use Cloudflare for DNS already. Might eliminate the redirect risk entirely. Do you all use the Cloudflare API token with acme.sh, or certbot's Cloudflare plugin? The plugin had dependency hell last I checked.