"Renew Now" feature for Letsencrypt addon

Feature Requests
1

The Letsencrypt addon needs a way to force immediate renewal.

Some of us use HTTP verification of domain name ownership, and don’t leave HTTP open all the time. So I have to adjust my firewall settings to proxy inbound port 80 to HomeAssistant when I want to renew.

Simply clicking “start” on the addon will attempt renewal but will fail to renew unless VERY close to certificate expiry.

I’m about to go on vacation for a month and my cert expires in just over two weeks. However I cannot renew now because the addon says that the certificate is not ready for renewal. I use letsencrypt certificates on other hosts on my home network and was able to renew those certs just fine with the certbot tool from LetsEncrypt, and they have similar expiry dates.

So, It’s likely that I’m not going to be able to renew my certificate before I leave, and will return to a broken admin UI due to an expired certificate.

I’d be happy if there were even a simple way to invoke certbot from the command line, but I’m afraid to install it for fears of conflicts with the addon.

Thank you,
Eric

2

just restart the addon every day with an automation. Or use a ping sensor to restart the addon when you can’t reach outside.

3

Letsencrypt itself let you renew if the certificate is deemed to expire in less than 30 days.
I don’t see anything in the addon that would override that behaviour

4

Here an automation that will restart the add-on 3 weeks before expiring

alias: "@Let's encrypt certificate check"
description: Will expire in 3 weeks
trigger:
  - platform: time
    at: "04:00:00"
condition:
  - condition: template
    value_template: >-
      {{ (states('sensor.cert_expiry_timestamp_ha_domain_my') | as_datetime
      or now()) - timedelta(days=21) < now()}}
action:
  - service: notify.mobile_app_myiphone
    data:
      title: Let's Encrypt
      message: Certificate will expire in 3 weeks, trying to renew, please verify
  - service: hassio.addon_start
    data:
      addon: core_letsencrypt
mode: single

Ofc, HA will still need a restart (but also that can be automated easilly)
But I figure I’d restart within 3 weeks anyway (just don’t like to have a automated unscheduled reboot :wink: )

2 Likes
5

Hey,

Just wondering. This causes the automation to run more often than it should in my case. It runs every 1 week or so somehow. Any ideas?

6

You’re missing the definition of how sensor.cert_expiry_timestamp_ha_domain_my gets populated.

Edit: I see I just need to install the Certificate Expiry addon

1 Like