Correct order of operations for the cron job for valid renewal

[instantdreams]

I'm running acme.sh in a docker container. Everything works, but I desire more knowledge as to how the account.conf file is used by the cron job.

My compose.yaml file looks like this:

services:
  acme-sh:
    image: neilpang/acme.sh:latest
    container_name: acme-sh
    command: daemon
    env_file:
      - .env
    volumes:
      - /srv/acme-sh/data:/acme.sh
      - /srv/acme-sh/certs:/srv/certs
      - /etc/localtime:/etc/localtime:ro
    restart: unless-stopped

My .env file contains the following:

# Container specifics
AZUREDNS_SUBSCRIPTIONID=[SubscriptionID]
AZUREDNS_TENANTID=[DirectoryTenantID]
AZUREDNS_APPID=[ApplicationClientID]
AZUREDNS_CLIENTSECRET=[SecretValue]
TELEGRAM_BOT_APITOKEN=[ApiToken]
TELEGRAM_BOT_CHATID=[ChatID]

I want to check the order of operations for the commands I entered to ensure everything runs correctly. With the container running, I issue the following commands:

docker exec acme-sh --register-account --email [email protected]
docker exec acme-sh --set-notify --notify-hook telegram
docker exec acme-sh --set-default-ca --server letsencrypt
docker exec acme-sh --issue --dns dns_azure --domain *.example.com
docker exec acme-sh --install-cert --dns dns_azure --domain *.example.com --ecc --cert-file /srv/certs/example-com-cert.pem --key-file /srv/certs/example-com-key.pem --ca-file /srv/certs/example-com-ca.pem --fullchain-file /srv/certs/example-com-full.pem

Everything here completes correctly:

$ docker exec acme-sh --register-account --email [email protected]
[Tue Feb 11 09:21:44 MST 2025] Registering account: https://acme-v02.api.letsencrypt.org/directory
[Tue Feb 11 09:21:45 MST 2025] Already registered
[Tue Feb 11 09:21:45 MST 2025] ACCOUNT_THUMBPRINT='[redacted]'

$ docker exec acme-sh --set-notify --notify-hook telegram
[Tue Feb 11 09:21:50 MST 2025] Set notify hook to: telegram
[Tue Feb 11 09:21:50 MST 2025] Sending via: telegram
[Tue Feb 11 09:21:51 MST 2025] telegram send success.
[Tue Feb 11 09:21:51 MST 2025] telegram Success

$ docker exec acme-sh --set-default-ca --server letsencrypt
[Tue Feb 11 09:22:17 MST 2025] Changed default CA to: https://acme-v02.api.letsencrypt.org/directory

$ docker exec acme-sh --issue --dns dns_azure --domain *.example.com
[Tue Feb 11 09:22:29 MST 2025] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Tue Feb 11 09:22:29 MST 2025] Single domain='*.example.com'
[Tue Feb 11 09:22:31 MST 2025] Getting webroot for domain='*.example.com'
[Tue Feb 11 09:22:31 MST 2025] Adding TXT value: [redacted] for domain: _acme-challenge.example.com
[Tue Feb 11 09:22:31 MST 2025] You didn't ask to use Azure managed identity, checking service principal credentials or provided bearer token
[Tue Feb 11 09:22:34 MST 2025] validation value added
[Tue Feb 11 09:22:34 MST 2025] The TXT record has been successfully added.
[Tue Feb 11 09:22:34 MST 2025] Let's check each DNS record now. Sleeping for 20 seconds first.
[Tue Feb 11 09:22:54 MST 2025] You can use '--dnssleep' to disable public dns checks.
[Tue Feb 11 09:22:54 MST 2025] See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck
[Tue Feb 11 09:22:54 MST 2025] Checking example.com for _acme-challenge.example.com
[Tue Feb 11 09:22:55 MST 2025] Success for domain example.com '_acme-challenge.example.com'.
[Tue Feb 11 09:22:55 MST 2025] All checks succeeded
[Tue Feb 11 09:22:55 MST 2025] Verifying: *.example.com
[Tue Feb 11 09:22:56 MST 2025] Pending. The CA is processing your order, please wait. (1/30)
[Tue Feb 11 09:22:58 MST 2025] Success
[Tue Feb 11 09:22:58 MST 2025] Removing DNS records.
[Tue Feb 11 09:22:58 MST 2025] Removing txt: [redacted] for domain: _acme-challenge.example.com
[Tue Feb 11 09:22:58 MST 2025] You didn't ask to use Azure managed identity, checking service principal credentials or provided bearer token
[Tue Feb 11 09:23:00 MST 2025] validation record removed
[Tue Feb 11 09:23:00 MST 2025] Successfully removed
[Tue Feb 11 09:23:00 MST 2025] Verification finished, beginning signing.
[Tue Feb 11 09:23:00 MST 2025] Let's finalize the order.
[Tue Feb 11 09:23:00 MST 2025] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/[redacted]'
[Tue Feb 11 09:23:02 MST 2025] Downloading cert.
[Tue Feb 11 09:23:02 MST 2025] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/[redacted]'
[Tue Feb 11 09:23:03 MST 2025] Cert success.
[Tue Feb 11 09:23:03 MST 2025] Your cert is in: /acme.sh/*.example.com_ecc/*.example.com.cer
[Tue Feb 11 09:23:03 MST 2025] Your cert key is in: /acme.sh/*.example.com_ecc/*.example.com.key
[Tue Feb 11 09:23:03 MST 2025] The intermediate CA cert is in: /acme.sh/*.example.com_ecc/ca.cer
[Tue Feb 11 09:23:03 MST 2025] And the full-chain cert is in: /acme.sh/*.example.com_ecc/fullchain.cer

$ docker exec acme-sh --install-cert --dns dns_azure --domain *.example.com --ecc --cert-file /srv/certs/example-com-cert.p
em --key-file /srv/certs/example-com-key.pem --ca-file /srv/certs/example-com-ca.pem --fullchain-file /srv/certs/example-com-full.pem
[Tue Feb 11 10:40:51 MST 2025] Installing cert to: /srv/certs/example-com-cert.pem
[Tue Feb 11 10:40:51 MST 2025] Installing CA to: /srv/certs/example-com-ca.pem
[Tue Feb 11 10:40:51 MST 2025] Installing key to: /srv/certs/example-com-key.pem
[Tue Feb 11 10:40:51 MST 2025] Installing full chain to: /srv/certs/example-com-full.pem

I am assuming that when the next renewal occurs, the cron job will run the --install-cert command. I am making this assumption because the last command I entered was an --install-cert job without the --dns dns_azure flag, and my logs reported a failure:

acme-sh  | [Mon Feb 10 01:10:01 MST 2025] ===Starting cron===
acme-sh  | [Mon Feb 10 01:10:02 MST 2025] Already up to date!
acme-sh  | [Mon Feb 10 01:10:02 MST 2025] Upgrade successful!
acme-sh  | [Mon Feb 10 01:10:02 MST 2025] Automatically upgraded to: 3.1.0
acme-sh  | [Mon Feb 10 01:10:02 MST 2025] Renewing: '*.example.com'
acme-sh  | [Mon Feb 10 01:10:02 MST 2025] Renewing using Le_API=https://acme-v02.api.letsencrypt.org/directory
acme-sh  | [Mon Feb 10 01:10:02 MST 2025] Skipping. Next renewal time is: 2025-02-10T23:58:52Z
acme-sh  | [Mon Feb 10 01:10:02 MST 2025] Add '--force' to force renewal.
acme-sh  | [Mon Feb 10 01:10:02 MST 2025] Skipped *.example.com_ecc
acme-sh  | [Mon Feb 10 01:10:02 MST 2025] ===End cron===
acme-sh  | [Tue Feb 11 01:10:02 MST 2025] ===Starting cron===
acme-sh  | [Tue Feb 11 01:10:02 MST 2025] Already up to date!
acme-sh  | [Tue Feb 11 01:10:02 MST 2025] Upgrade successful!
acme-sh  | [Tue Feb 11 01:10:02 MST 2025] Automatically upgraded to: 3.1.0
acme-sh  | [Tue Feb 11 01:10:02 MST 2025] Renewing: '*.example.com'
acme-sh  | [Tue Feb 11 01:10:02 MST 2025] Renewing using Le_API=https://acme-v02.api.letsencrypt.org/directory
acme-sh  | [Tue Feb 11 01:10:03 MST 2025] Using CA: https://acme-v02.api.letsencrypt.org/directory
acme-sh  | [Tue Feb 11 01:10:03 MST 2025] Multi domain='DNS:*.example.com,DNS:*.example.com'
acme-sh  | [Tue Feb 11 01:10:05 MST 2025] Getting webroot for domain='*.example.com'
acme-sh  | [Tue Feb 11 01:10:06 MST 2025] Cannot get domain token entry *.example.com for http-01
acme-sh  | [Tue Feb 11 01:10:06 MST 2025] Supported validation types are: dns-01 , but you specified: http-01
acme-sh  | [Tue Feb 11 01:10:06 MST 2025] Please add '--debug' or '--log' to see more information.
acme-sh  | [Tue Feb 11 01:10:06 MST 2025] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
acme-sh  | [Tue Feb 11 01:10:06 MST 2025] Error renewing *.example.com_ecc.
acme-sh  | [Tue Feb 11 01:10:06 MST 2025] Sending via: telegram
acme-sh  | [Tue Feb 11 01:10:07 MST 2025] telegram send success.
acme-sh  | [Tue Feb 11 01:10:07 MST 2025] telegram Success
acme-sh  | [Tue Feb 11 01:10:07 MST 2025] ===End cron===

I am hoping that entering the commands again with the explicit --dns dns_azure command flag for the --install-cert command will make this work successfully. I use the --install-certs command to a bind mount folder which is also mounted by my traefik instance. It dynamically picks up the wildcard certificates for my local services and works well.

I'd like to be able to determine what the acme.sh cron job settings are. When I check the docker container I can see the task to run the ---cron command:

$ docker exec acme-sh cat /etc/crontabs/root
10 1 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" --config-home "/acme.sh" > /proc/1/fd/1 2>/proc/1/fd/2

But where would I find what command will be triggered by this? The account.conf file doesn't specify anything:

$ docker exec acme-sh-1 cat /acme.sh/account.conf
AUTO_UPGRADE='1'
SAVED_TELEGRAM_BOT_APITOKEN='[redacted]'
SAVED_TELEGRAM_BOT_CHATID='[redacted]'
NOTIFY_HOOK='telegram'
DEFAULT_ACME_SERVER='https://acme-v02.api.letsencrypt.org/directory'
USER_PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
UPGRADE_HASH='[redacted]'
SAVED_AZUREDNS_SUBSCRIPTIONID='[redacted]'
SAVED_AZUREDNS_MANAGEDIDENTITY='false'
SAVED_AZUREDNS_TENANTID='[redacted]'
SAVED_AZUREDNS_APPID='[redacted]'
SAVED_AZUREDNS_CLIENTSECRET='[redacted]'
SAVED_AZUREDNS_BEARERTOKEN=''
SAVED_AZUREDNS_ACCESSTOKEN='[redacted]'
SAVED_AZUREDNS_TOKENVALIDTO='[redacted]'

Is it something to do with the domain configuration file:

$ docker exec acme-sh-1 cat /acme.sh/\*.instantdreams.org_ecc/\*.instantdreams.org.conf
Le_Domain='*.example.com'
Le_Alt='no'
Le_Webroot='dns_azure'
Le_PreHook=''
Le_PostHook=''
Le_RenewHook=''
Le_API='https://acme-v02.api.letsencrypt.org/directory'
Le_Keylength='ec-256'
Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/[redacted]'
Le_LinkOrder='https://acme-v02.api.letsencrypt.org/acme/order/[redacted]'
Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/[redacted]'
Le_CertCreateTime='[redacted]'
Le_CertCreateTimeStr='[redacted]'
Le_NextRenewTimeStr='[redacted]'
Le_NextRenewTime='[redacted]'
Le_RealCertPath='/srv/certs/example-com-cert.pem'
Le_RealCACertPath='/srv/certs/example-com-ca.pem'
Le_RealKeyPath='/srv/certs/example-com-key.pem'
Le_ReloadCmd=''
Le_RealFullChainPath='/srv/certs/example-com-full.pem'

I can't quite see what the cron job itself does, and I've searched extensively. Any help is appreciated!

[Neilpang]

Is it something to do with the domain configuration file:

yes, it's in the domain conf file. Le_ReloadCmd and Le_RenewHook

[instantdreams]

After #6230 where I configured the docker deploy hook I can see entries in the conf file now - I'll wait until the renew occurs to check, but thank you!