acme.sh on a Server Where certbot Will Not Install

On a server where certbot failed to install, four sites went dark due to a TLS handshake failure. The issue originated from an expired license for a control panel, causing its daily renewal cron job to fail. With seven certificates nearing expiration, the solution was found using acme.sh, a shell script that required minimal dependencies and did not depend on certbot.

The installation of acme.sh was straightforward, requiring only bash and curl or wget. By default, it uses ZeroSSL instead of Let's Encrypt, which necessitated a simple set-default-ca command followed by registration of an account. Once set, acme.sh could be used to issue certificates for the relevant domains without touching the existing vhost files.

To avoid edits in the web server configuration, the script used webroot validation into an already served directory and wrote the certificate to the filenames the server expected. This eliminated the need for changes to the web server configuration, as the paths remained unchanged.

A crucial aspect of the solution was ensuring that expired certificates did not block renewal, as Let's Encrypt follows redirects during the HTTP-01 challenge and does not validate the certificate. No need to unwind redirects, as this was already handled by Let's Encrypt.

The installation process included setting up a cron job to automate renews, which previously failed due to a rival cron job running at a different hour. By reviewing the crontab, the issue was identified and resolved by commenting out the redundant entry.

To monitor the certificates, a daily script was created to check the handshake and alert if the served certificate was nearing expiration. This method proved effective, as it detected the original outage and prevented similar silent failures in the future.