Let's Encrypt Staging workflow is problematic

[giggio]

Describe the issue you are experiencing

If you test on Let's encrypt staging, after you remove the server the addon will not issue a new certificate, even if you try to remove the certificates fom /ssl.

What type of installation are you running?

Home Assistant OS

Which operating system are you running on?

Home Assistant Operating System

Which add-on are you reporting an issue with?

Let's Encrypt

What is the version of the add-on?

5.0.18

Steps to reproduce the issue

1. Install the addon
2. Test the configuration using acme_server: https://acme-staging-v02.api.letsencrypt.org/
3. Check certs were issued on /ssl.
4. Remove the acme_server config and certs from /ssl.
5. Start the addon again, it will recreate the staging certificates.

System Health information

N/A.

Anything in the Supervisor logs that might be useful for us?

N/A.

Anything in the add-on logs that might be useful for us?

cont-init: info: running /etc/cont-init.d/file-structure.sh
cont-init: info: /etc/cont-init.d/file-structure.sh exited 0
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service legacy-services: starting
services-up: info: copying legacy longrun lets-encrypt (no readiness notification)
s6-rc: info: service legacy-services successfully started
[21:04:37] INFO: Selected DNS Provider: dns-cloudflare
[21:04:37] INFO: Use propagation seconds: 60
[21:04:37] INFO: Use CloudFlare token
[21:04:37] INFO: Detecting existing certificate type for xxx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
[21:04:38] INFO: Existing certificate using 'ecdsa' key type.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Certificate not yet due for renewal

Additional information

Originally reported at #1705, but incorrectly closed as stale.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[giggio]

Not stale.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[giggio]

Not stale.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[giggio]

Not stale.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[giggio]

Not stale.

[GoetzGoerisch]

Could you please verify with the update certbot version.

letsencrypt v5.3.3

If this is still the case I will look deeper into this.

[giggio]

Could you please verify with the update certbot version.

letsencrypt v5.3.3

If this is still the case I will look deeper into this.

@GoetzGoerisch My current configuration is using the production server (https://acme-v02.api.letsencrypt.org/). I changed it to the staging one, deleted all files from /ssl and restarted the addon. No new certs were issued.

This workflow is still problematic for anyone who wants to first test their setup using staging, and then move to the production server. Changing the acme server should issue a new cert. It currently does not do that.

[GoetzGoerisch]

@giggio Thank you for the update.
I looked into the code and am preparing an update #3943
This includes an easy switch for issuing test certificates.

Nevertheless due to --keep-until-expiring. The default behavior is to never renew until it is expiring.

addons/letsencrypt/rootfs/etc/services.d/lets-encrypt/run

Line 348 in 13c92fd

certbot certonly --non-interactive --keep-until-expiring --expand \

@agners my proposal would be to make this option configurable and have a sane default value and also add a "--force-renewal" switch