Nextcloud-snap: Cannot renew Let's Encrypt certificate

[Nubzori]

Hello,

I am having a weird problem, my cert did not renew automatically. My ip has changed to different one during this 90 day certificate. I've changed my domain to point into my new ip.
I tried:

sudo nextcloud.enable-https lets-encrypt

but it gives me this error:

An unexpected error occurred: IOError: [Errno 13] Permission denied: '/etc/letsencrypt/cli.ini' Please see the logfile '/tmp/tmpdvL2dk' for more details.
Logfile contains same error message:

2018-05-10 23:38:30,567:DEBUG:certbot.main:certbot version: 0.14.1 2018-05-10 23:38:30,567:DEBUG:certbot.main:Arguments: ['--text', '--config-dir', '/var/snap/nextcloud/current/certs/certbot/config', '--work-dir', '/var/snap/nextcloud/current/certs/certbot/work', '--logs-dir', '/var/snap/nextcloud/current/certs/certbot/logs', '--post-hook', 'restart-apache'] 2018-05-10 23:38:30,567:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#nextcloud:webroot,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot) 2018-05-10 23:38:30,572:DEBUG:certbot.log:Exiting abnormally: Traceback (most recent call last): File "/snap/nextcloud/6916/bin/certbot", line 11, in <module> sys.exit(main()) File "/snap/nextcloud/6916/lib/python2.7/site-packages/certbot/main.py", line 729, in main args = cli.prepare_and_parse_args(plugins, cli_args) File "/snap/nextcloud/6916/lib/python2.7/site-packages/certbot/cli.py", line 1101, in prepare_and_parse_args return helpful.parse_args() File "/snap/nextcloud/6916/lib/python2.7/site-packages/certbot/cli.py", line 534, in parse_args parsed_args = self.parser.parse_args(self.args) File "/snap/nextcloud/6916/lib/python2.7/site-packages/configargparse.py", line 373, in parse_args env_vars = env_vars) File "/snap/nextcloud/6916/lib/python2.7/site-packages/configargparse.py", line 472, in parse_known_args config_streams = self._open_config_files(args) File "/snap/nextcloud/6916/lib/python2.7/site-packages/configargparse.py", line 715, in _open_config_files for f in files] IOError: [Errno 13] Permission denied: '/etc/letsencrypt/cli.ini' ~
Running sudo journalctl -u snap.nextcloud.renew-certs
contains this:

-- Logs begin at Tue 2018-05-08 23:37:50 EEST, end at Fri 2018-05-11 15:16:45 EEST. -- May 08 23:38:21 asuka systemd[1]: Started Service for snap application nextcloud.renew-certs. May 08 23:38:23 asuka nextcloud.renew-certs[1831]: Self-signed certificates aren't due for renewal May 08 23:38:28 asuka nextcloud.renew-certs[1831]: An unexpected error occurred: May 08 23:38:28 asuka nextcloud.renew-certs[1831]: IOError: [Errno 13] Permission denied: '/etc/letsencrypt/cli.ini' May 08 23:38:28 asuka nextcloud.renew-certs[1831]: Please see the logfile '/tmp/tmpIe8fch' for more details. May 09 23:38:28 asuka nextcloud.renew-certs[1831]: Self-signed certificates aren't due for renewal May 09 23:38:29 asuka nextcloud.renew-certs[1831]: An unexpected error occurred: May 09 23:38:29 asuka nextcloud.renew-certs[1831]: IOError: [Errno 13] Permission denied: '/etc/letsencrypt/cli.ini' May 09 23:38:29 asuka nextcloud.renew-certs[1831]: Please see the logfile '/tmp/tmpnJWLrf' for more details. May 10 23:38:29 asuka nextcloud.renew-certs[1831]: Self-signed certificates aren't due for renewal May 10 23:38:30 asuka nextcloud.renew-certs[1831]: An unexpected error occurred: May 10 23:38:30 asuka nextcloud.renew-certs[1831]: IOError: [Errno 13] Permission denied: '/etc/letsencrypt/cli.ini' May 10 23:38:30 asuka nextcloud.renew-certs[1831]: Please see the logfile '/tmp/tmp6YFSR3' for more details.

snap version:

snap 2.32.6 snapd 2.32.6 series 16 ubuntu 16.04 kernel 4.4.0-119-generic

Any ideas what to do?

[kyrofa]

This sounds oddly like certbot/lets-encrypt is being run off of the host instead of the one in the snap. Are you running standard ubuntu 16.04? Did you install the snap in devmode or anything like that?

[Nubzori]

I'm running ubuntu 16.04 server, and I used the instructions from here:

https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-nextcloud-on-ubuntu-16-04

[kyrofa]

Huh, okay. Let's do some sanity checks, then. You're on amd64, I assume? Please show me the result of the following command:

$ curl -s https://gist.githubusercontent.com/kyrofa/a573c4ef704a9a5008669e6131de293a/raw/bdf06c27aba2a92607d9e55cbfa341e91961cb0c/debugger.sh | bash

(feel free to take a look at the script before running it; I assure you, it's harmless)

[Nubzori]

I'm running this on amd64 yes. Here is the output:

certbot location: /snap/nextcloud/6916/bin/certbot
lib location: /snap/nextcloud/6916/lib/python2.7/site-packages/certbot/main.py

[kyrofa]

I'm curious: does /etc/letsencrypt/cli.ini actually exist?

[Nubzori]

It does

ls -a /etc/letsencrypt/ . accounts csr options-ssl-apache.conf renewal-hooks .. cli.ini keys renewal .updated-options-ssl-apache-conf-digest.txt

[kyrofa]

Are you using it for anything? Can you try moving it out of the way to see if that changes things? I'm working on bringing certbot up to date to see if that will help.

[kyrofa]

Ah, yep. Updating certbot won't help (although I'll be doing that anyway). I can duplicate this if I create /etc/letsencrypt/cli.ini. If you can move it out of the way, this will start working again (even if you only do it long enough to renew). I'll try to figure out a way to stop that from happening.

[kyrofa]

Gah, it's a known issue. I'll have to patch certbot. This is also an apparmor bug that I raised back in 2016-- certbot shouldn't even know this file exists due to confinement, but it does-- it just can't _access_ it.

[Nubzori]

Yup, moving /etc/letsencrypt/cli.ini worked, or in my case I just renamed it. A weird fix but I have a working cert now though, thanks for the help.

[kyrofa]

If you're able, would you mind giving #573 a test? Instructions are in the PR description.

[Nubzori]

573 works, I can get a let's encrypt certificate while /etc/letsencrypt/cli.ini exist

[kyrofa]

Thank you, @Nubzori!

[davidbuzz]

+1 for me experiencing this error on a basically stock ubuntu 16.04 and a basically stock snap. renaming the real /etc/letsencrypt/cli.ini out of the way fixed it for me.

[kyrofa]

Thanks @davidbuzz! This is fixed in the beta channel, I just need to crank out a release this weekend.