Manual Cert Renewal Command?

[Joshndroid]

Hello All,

I run my matrix server at home and not facing the outside world.
The only time I run it in this fashion is during cert renewal, opening the ports, running a renewal, then closing it back up again.

I used to be able to run the command

/usr/local/bin/matrix-ssl-lets-encrypt-certificates-renew

and then run

systemctl reload matrix-nginx-proxy

I assume with the move to traefik this command no longer functions.

Is there a manual way that I can keep certs updated so I dont have to try and time the renewal in order to open ports/etc

I have checked the docs and it does not list anything that I can see thus far, any tips to help?

[sneaker8650]

I would also be interested in that. My certificate expires in 20 days, unfortunately no restart of traefik or the whole server helps.

[Joshndroid]

I have 5 days left. Any thoughts on what I do from a manual perspective?

[spantaleev]

Follow Traefik's logs (journalctl -fu matrix-traefik) and restart it in the meantime while looking at the logs (systemctl restart matrix-traefik).

It should try to renew all certificates. If it fails, it would tell you what the errors are, so you can take action.

[Joshndroid]

Hey @spantaleev

I went through this and had 2 x SSH tunnels running at the same time.
The traffaek log was hard to understand in that it only showed 1 x cert renewal.... so I then re-run the command again and it showed 1 x cert renewal but on this occasion it was for a different sub-domain. At this point I closed up my ports and re-established my DNS re-writes. It seems to break element as it never wanted to connect again. I then reboot the matrix server VM and it did not appear to fix it. I then ran a full git pull, just roles and just setup -all command and closed/reopened element and it came back. It's possible i didn't need to do the updating of the ansible only required a close/reopen of element but i can't say for certain at this time

You may want to update/fix the docs to add in this bit @spantaleev so users like myself can keep this going the manual way :)

Thanks

@sneaker8650 have a look at this mate and give it a go... you should be alright.

[fkonradmain]

I would also argue, that such a job would be helpful, if you want to switch from ACME staging Certificates to the actual certificates. That case happens easily, when you are debugging a fresh Matrix installation.

In my case it was easier to just delete Matrix and reinstall it, because there is no way to force update the certificates from ansible's side. (to my knowledge)