I run acme.sh on Hetzner VPS in Helsinki. Works fine. But the real fix for FlowSana is not the client, it is the cron.
That runs every day. Use the systemd timer if available, or at least randomize:
0 3 * * * sleep $((RANDOM % 3600)); certbot renew --quietSpreads the load. OVH Gravelines at 03:00 UTC is a thundering herd.
Confirmed. I have white-label clients on OVH VPS in Gravelines and Roubaix. 03:00-04:00 UTC is when every French host runs maintenance and every certbot fires. I moved all mine to 05:17 with jitter.
Also: check if your nginx reload is the problem. certbot --nginx should handle it, but if you have a custom deploy-hook that calls systemctl reload nginx, and two instances run, the second reload hits a still-starting nginx and fails.
I saw this with a client who had both --deploy-hook and --post-hook. Pick one.
I had --post-hook "systemctl reload nginx". Only one. But with two certbot instances, the second reload definitely collided.
Fixed the duplicate cron. Added jitter. Will report back in 89 days I guess — https://letsencrypt.org
Still annoyed I never noticed the duplicate.
I had this exact pattern on a BuyVM slice in Las Vegas. Turned out to be cron + anacron. Debian defaults to anacron for machines that might be off at night, but VPS is always on so both run.
Check /etc/cron.d/anacron and /etc/anacrontab.
Anacron does not run on systems with systemd. Debian 12 uses systemd timers for everything unless you explicitly install anacron.
More likely: apt upgrade pulled in a new certbot package that re-added /etc/cron.d/certbot, and the old one from manual setup stayed. I have seen dpkg ask about conffiles and the user says "keep my version", so now you have two.
I am on Netgsm for DNS here in Istanbul, not hosting, but the time sync issue hadesgreat0 mentioned is real.
Turkish ISPs often have NTP blocked or redirected. I run chrony with pool.ntp.org and still see 30-50ms offsets on some days. Not enough to break certbot but enough to annoy me.
For SSL I just pay Cloudflare for the origin cert. 15 years, done.
Member
Cloudflare origin certs only work if you proxy through Cloudflare. If you need direct access, useless.
Also, 15 years is nice until you forget where you put the private key.
This thread saved me. I had triple certbot on my DigitalOcean droplet: cron.d, root crontab, and a leftover from a tutorial that put it in /etc/cron.hourly.
Found it with:
grep -r certbot /etc/cron* /var/spool/cron/Should be a PSA.
Following. I have the same setup on Vultr Tokyo and never had this, but now I am going to check.
Same here on RackNerd LA. Checked, only one cron. Maybe I got lucky with the install method.