Just for completeness, I have 2 RB4011 boxes, one at our “main site” and one at my home as my home router. Both are running ROS 7.16.2.
The one at our main site is where I am having the troubles with the certificate renewal script. The same script is on both boxes.
Here’s the script (with sensitive info removed for privacy):
:log info "Script - Certificate renewal started"
:local commName "[xxx]"
:log info "Script - Enable WWW Service"
/ip service set disabled=no [find where name="www"]
:log info "Script - Enable WWW Service [DONE]"
:log info "Script - Enable Firewall rule for port 80"
/ip firewall filter enable [find where comment="LetsEncrypt"]
:log info "Script - Enable Firewall rule for port 80 [DONE]"
#Delete old certificate, create new certificate
:log info "Script - Delete old certificate"
/certificate remove [find where common-name=$commName]
:log info "Script - Delete old certificate [DONE]"
:log info "Script - Request new certificate"
/certificate enable-ssl-certificate dns=$commName
#Delay to allow certificate to be requested and downloaded
:delay 60s
:log info "Script - Request new certificate [DONE]"
/certificate
:local certName [get [find where common-name=$commName] name]
#Set new certificate in SSTP Profile
:log info "Script - Set new certificate in SSTP Profile"
/interface sstp-server server set certificate=$certName
:log info "Script - Set new certificate in SSTP Profile [DONE]"
#Set new certificate in Hotspot profile
:log info "Script - Set new certificate in Hotspot Profile"
/ip hotspot profile set ssl-certificate=$certName [find where name="Hotspot"]
:log info "Script - Set new certificate in Hotspot Profile [DONE]"
:log info "Script - Disable WWW Service"
/ip service set disabled=yes [find where name="www"]
:log info "Script - Disable WWW Service [DONE]"
:log info "Script - Disable firewall rule for port 80"
/ip firewall filter disable [find where comment="LetsEncrypt"]
:log info "Script - Disable firewall rule for port 80 [DONE]"
:log info "Script - Certificate renewal finished"
Here’s the part of the config that relates to the script (with the permissions):
/system script add dont-require-permissions=yes name=letsencrypt-renew owner=admin policy=read,write source="[Script Source Code as above]"
And here’s the config item for the scheduled task for this script:
/system scheduler add interval=10w5d name=letsencrypt-renew on-event=letsencrypt-renew policy=read,write start-date=2023-08-28 start-time=09:00:00
COUNTERS
I have 2 scripts (one for config backup, and the above certificate renewal)
Config Backup (main site box) shows the same number in both script counter and scheduler counter.
Certificate renewal script (main site box) shows 12 in the script counter and only 1 in the scheduler counter.
Interestingly though, when I check my home box (where the automatic script is running correctly, as I can see that the certificate itself on my home box was issued only about 3 days ago), I see a similar situation… 8 for the script counter and 1 for the scheduler.
QUESTION - if the script failed part way through, would any of it run? I put all the logging statements in the script to see if I could trap where something was failing. I see all the log entries correctly when running the script manually, but nothing when running (or trying) from the scheduler. But then, the script runs manually fine, so there can’t be that much wrong with it.
Or would the scheduler only count up one if the whole task had completed successfully maybe?
Unfortunately, by the time we’ve realised that the certificate on the main site box hasn’t renewed properly, the logs are full of other stuff and we can’t don’t see what did and didn’t run. I’ve now implemented some SYSLOG logging with a log capturing tool I created that logs everything to an SQL database…
As I say, running the above script manually from the script editor works absolutely fine. So the only thing I can think of is that it is indeed permissions.
Any thoughts or advice very gratefully received.