I continue the discussion from Bug#822493 here:

Please provide a cron based automatism for refreshing certificates.

It would be nice that users only need to provide the hostname(s) they
want to get a certificate for in /etc/letsencrypt.sh/ and a cronjob
that runs letsencrypt.sh -c takes care for refreshing it before it expires.

That script would also need hooks to reload daemons that need to know
about a certificate-change.

Debconf could ask if automatic refresh is activated.

Cord

On Fri, May 13, 2016 at 22:28:30 +0200, Cord Beermann wrote:
[...]
[...]

Could my hook.d idea in #827371 possibly help with this?


Cheers

    Elrond

How about add a systemd service like certbot?

A modified version from certbot package:

/lib/systemd/system/letsencrypt.sh.service

[Unit]
Description=letsencrypt.sh
Documentation=file:///usr/share/doc/letsencrypt.sh/README.Debian
[Service]
Type=oneshot
ExecStart=/usr/bin/letsencrypt.sh -c
PrivateTmp=true

/lib/systemd/system/letsencrypt.sh.timer

[Unit]
Description=Run letsencrypt.sh twice daily

[Timer]
OnCalendar=*-*-* 00,12:00:00
RandomizedDelaySec=3600
Persistent=true

[Install]
WantedBy=timers.target

Hello,

attaching short examples for cron and logrotate scripts as they work on some
servers maintained by us. Works without systemd too.

1. /etc/cron.daily/dehydrated

#!/bin/sh
dehydrated -c >> /var/log/dehydrated.log


2. /etc/logrotate.d/dehydrated

/var/log/dehydrated.log
{
	missingok
	yearly
}

An example cron job script is provided by the hosting company Mythic Beasts
at: https://www.mythic-beasts.com/support/domains/letsencrypt_dns_01

/etc/cron.daily/dehydrated:
#!/bin/sh
exec /usr/bin/dehydrated -c >>/var/log/dehydrated-cron.log 2>&1

/etc/logrotate.d/dehydrated:
/var/log/dehydrated-cron.log
{
        rotate 12
        monthly
        missingok
        notifempty
        delaycompress
        compress
}

It would be great to see this functionality added to the Debian package!