Reproduce:
set pki certificate vyos acme domain-name 'router.vyos.net' set pki certificate vyos acme email 'foo@bar.com' set pki certificate vyos acme url 'https://acme-staging-v02.api.letsencrypt.org/directory' set vpn openconnect authentication local-users username soasdf564654 password 'vyos1234' set vpn openconnect authentication mode local 'password' set vpn openconnect network-settings client-ip-settings subnet '10.0.0.0/29' set vpn openconnect network-settings name-server '1.1.1.1' set vpn openconnect ssl certificate vyos
Force renewal using: sudo /usr/bin/certbot renew --config-dir /config/auth/letsencrypt --no-random-sleep-on-renew --post-hook "/usr/libexec/vyos/vyos-certbot-renew-pki.sh" --force-renewal
The main issue is that if a certbot renewal is triggered, we do NOT add any dependencies to call other configuration paths
https://github.com/vyos/vyos-1x/blob/f1ccb39b2a93b8a1cc0ee83403ee681910d22fbb/src/conf_mode/pki.py#L150-L151
This would do the immediate job - but it's only a partial fix and would call the openconnect dependency even it might not be needed at all. It also misses out e.g. IPSec VPN, HaProxy or http server
diff --git c/src/conf_mode/pki.py i/src/conf_mode/pki.py index acea2c9be..ea723e174 100755 --- c/src/conf_mode/pki.py +++ i/src/conf_mode/pki.py @@ -149,6 +149,7 @@ def get_config(config=None): if len(argv) > 1 and argv[1] == 'certbot_renew': pki['certbot_renew'] = {} + set_dependents('openconnect', conf) changed_keys = ['ca', 'certificate', 'dh', 'key-pair', 'openssh', 'openvpn'] @@ -506,7 +507,7 @@ def apply(pki): elif has_certbot and not is_systemd_service_active(systemd_certbot_name): call(f'systemctl restart {systemd_certbot_name}') - if 'changed' in pki: + if 'changed' in pki or 'certbot_renew' in pki: call_dependents() # Rebuild ca-certificates bundle