Christophe CasalegnoAutoimmune warrior, Entrepreneur & Bio/Hacker

brain@127.0.0.1:~$ cat post.html

Keep using let's encrypt on obsolete debian servers wheezy & sid (7 and 8)

By Christophe Casalegno on in Infosec, Linux

Hello friends, I hope you are well. If you still maintain a « Legacy » server fleet (yes, I know, it is bad: but if you work in this field, you know clients impose certain constraints. You can accept them or refuse, and watch the client leave) and you use certbot-auto to keep updating your let's encrypt SSL certificates, you have probably noticed for some time that it no longer works, and apparently the tool has even been removed from its original location.

Even so, it is still possible to get it working. In March or April 2019, I ran into this problem with a client still running debian 7 (wheezy) who had a similar issue. At the time, I patched the version of certbot-auto then available so the client could keep using let's encrypt certificates.

Not long ago, after further changes to the supported versions of ACME, I ran into the same thing with servers still on debian 8 (sid). Still remembering the name of the client for whom I had patched certbot-auto for version 7, I retrieved the file and then… miracle, it also works on debian 8. So I decided to share it with you. Enjoy!

You can find it via the contribution section or directly via the following link: certbot-auto.

Do not forget to use the –no-self-upgrade option ;) Enjoy the rest of the weekend, everyone.

Christophe Casalegno
​You can follow me on: Twitter | Facebook | Linkedin | Telegram | Youtube

11 comments

  1. Bonjour,

    merci du tuyau mais sur Debian 8 ca marche pas cela me dit

    Your system is not supported by certbot-auto anymore.
    certbot-auto and its Certbot installation will no longer receive updates.
    You will not receive any bug fixes including those fixing server compatibility
    or security problems.
    Please visit https://certbot.eff.org/ to check for other alternatives.
    An unexpected error occurred:
    CalledProcessError: Command ‘(‘lsb_release’, ‘-a’)’ returned non-zero exit status 1

    1. Hello xposer : je m’en sers sur plusieurs dizaines de machines en debian 8. Tu as bien remplacé le binaire et dit de ne pas mettre à jour ? Je viens de tester à l’instant, c’est toujours fonctionnel.

  2. Bonjour, est-ce que ce patch fonctionne toujours ? Su oui comment faut-il l’installer ? Juste en remplaçant l’ancien certbot-auto ?
    D’avance merci pour votre temps

    1. Bonjour Greg, oui ce patch fonctionne toujours. Il suffit en effet de remplacer certbot-auto, attention également comme indiqué dans le post à bien bloquer les mises à jour automatiques lors de son utilisation.

Leave a comment

Add a comment
Christophe Casalegno Brain 0verride

Keep it simple
and direct!