ecs-isp@2rosenthals.com ?????????????? ????? #1316

???: "Massimo S." <ecs-isp@2rosenthals.com> ?? ????
?????????
??: Re: [eCS-ISP] LE certificate renewal fails when using CRON2
??: Wed, 8 Apr 2026 09:12:17 +0200
??: eCS ISP Mailing List <ecs-isp@2rosenthals.com>

Il 08/04/2026 08:10, Steven Levine ha scritto:
In <list-2030831@2rosenthals.com>, on 04/07/26
    at 10:13 PM, "Massimo S." <ecs-isp@2rosenthals.com> said:

Hi Massimo,

if i start the script manually from the command line everything works
correctly, but instead when the script is started by the scheduler
(CRON2) it fails with this:

When did the start happening or did it never work from cron?

never, it only works if i start it manually

uacme: fetching directory at
https://acme-v02.api.letsencrypt.org/directory uacme: curl_get: GET
https://acme-v02.api.letsencrypt.org/directory failed: Problem with the
SSL CA cert  (path? access rights?)
uacme: curl_get: waiting 5 seconds before retrying

When Let's Encrypt is overloaded, it can have problems access with
accessing URLs on it's server.  The relevant code is

curlwrap.c:116
         res = curl_easy_perform(curl);
         if (res != CURLE_OK) {
             warnx("curl_get: GET %s failed: %s", url,
                     curl_easy_strerror(res));
             curldata_free(c);
             c = NULL;

I would normally suspect a problem at the server end, but since you can
run from the command line, it must be something else.

ATM, I have no idea what cron2 might be doing to mess up the runtime
environment for uacme, but it must be doing something.

You could try turning on logging.  You could try running full screen or
not minimized.


Steven

the script as first thing is copying a firerule that has port 80 open
for injoy fw, then it reload the fw rules

after it start webserve and after it start uacme

my suspect is that running it scheduled it don't execute something,
maybe it do not correctly open port 80 even if i see from logs
that the fw rules get reloaded

this is a mail server so port 80 is not opened by default
and webserve is ran only to renew the popS and TLS certificate

i've added a "go >file.txt", but i've seen that all the
right processes are loaded in memory while the script
is running

now i've added also a netstat -s and -l
i hope they can help

i've also seen curl stuff (dll, exe etc.) and they are on
pair with other VMs where the renewal works, but there
i'm not using webserve, but apache

massimo

???????: ????, ??????, ??????.
?????????
??? ????????