Use $RENEWED_LINEAGE and $RENEWED_DOMAINS from --renew-hooks about certbot-zimbra

[maxxer]

I noticed something strange on my installation... I'll have a look, but cannot promise an ETA, quite busy lately :(

[maxxer]

I just updated a 8.6RHEL7 and cert has been deployed fine. In the next days I'll have a chance to update an UBUNTU12 one, I'll let you know

[syphernl]

FWIW my Zimbra box runs on 14.04 but shouldn't make much difference probably.

[maxxer]

What does
openssl x509 -noout -dates -in /opt/zimbra/ssl/zimbra/commercial/commercial.crt
says?

[syphernl]

openssl x509 -noout -dates -in /opt/zimbra/ssl/zimbra/commercial/commercial.crt

notBefore=May 11 11:15:00 2017 GMT
notAfter=Aug  9 11:15:00 2017 GMT

[maxxer]

Are you sure the letsencrypt cert has been renewed? And that the certs in /opt/zimbra/ssl/letsencrypt/ are the renewed ones? Check with the same command

[syphernl]

The problem appears to be due to the fact that the script is getting the information from /etc/letsencrypt/live/zimbra.example.com while Certbot has created the new stuff into /etc/letsencrypt/live/zimbra.example.com-0001.

This may be due to the fact that the initial request was done with a SAN (Subject Alternative Name aka multi-domain certificate) but the new request dropped this to one hostname (which was intended).

Once i moved the zimbra.example.com to zimbra.example.com_old and zimbra.example.com-0001 to zimbra.example.com and now the commercial.crt has been replaced properly and is working fine now.

So the issue appears to be here that the script cannot deal with the fact that a certificate request can change and result in a new folder.

[maxxer]

I should take advantage of shell vars passed to the renew hook:

  --renew-hook RENEW_HOOK
                        Command to be run in a shell once for each
                        successfully renewed certificate. For this command,
                        the shell variable $RENEWED_LINEAGE will point to the
                        config live subdirectory (for example,
                        "/etc/letsencrypt/live/example.com") containing the
                        new certificates and keys; the shell variable
                        $RENEWED_DOMAINS will contain a space-delimited list
                        of renewed certificate domains (for example,
                        "example.com www.example.com" (default: None)

[maxxer]

I've pushed a test fix, if you have any chance to test it.