{"action":"opened","issue":{"url":"https://api.github.com/repos/letsencrypt/letsencrypt/issues/1504","labels_url":"https://api.github.com/repos/letsencrypt/letsencrypt/issues/1504/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/letsencrypt/issues/1504/comments","events_url":"https://api.github.com/repos/letsencrypt/letsencrypt/issues/1504/events","html_url":"https://github.com/letsencrypt/letsencrypt/issues/1504","id":116920916,"number":1504,"title":"Run script on renewal of certificate","user":{"login":"bwesterb","id":9975,"avatar_url":"https://avatars.githubusercontent.com/u/9975?v=3","gravatar_id":"","url":"https://api.github.com/users/bwesterb","html_url":"https://github.com/bwesterb","followers_url":"https://api.github.com/users/bwesterb/followers","following_url":"https://api.github.com/users/bwesterb/following{/other_user}","gists_url":"https://api.github.com/users/bwesterb/gists{/gist_id}","starred_url":"https://api.github.com/users/bwesterb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bwesterb/subscriptions","organizations_url":"https://api.github.com/users/bwesterb/orgs","repos_url":"https://api.github.com/users/bwesterb/repos","events_url":"https://api.github.com/users/bwesterb/events{/privacy}","received_events_url":"https://api.github.com/users/bwesterb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-14T11:50:47Z","updated_at":"2015-11-14T11:50:47Z","closed_at":null,"body":"The preferred way to use letsencrypt certificates, is pointing applications directly into `/etc/letsencrypt/live`.  However, for several reasons (see below), this might not work and some custom steps need to be taken to install a certificate for an application.  An admin should be able to install a script which is run on the renewal of a certificate to install it.\r\n\r\nA hypothetical implementation could work as follows\r\n\r\n    letsencrypt -d mydomain --on-renewal=/usr/local/bin/install-cert-for-lighttpd\r\n\r\nWith the script `/usr/local/bin/install-cert-for-lighttpd` containing, for instance\r\n\r\n    cat \"/etc/letsencrypt/live/$1/privkey.pem\" \"/etc/letsencrypt/live/$1/cert.pem\" > /etc/lighttpd/ssl/$1.pem\r\n    chown www-data:www-data /etc/lighttpd/ssl/$1.pem\r\n    service lighttpd reload\r\n\r\nSome reasons I can think of for a script are:\r\n\r\n1. The applications requires that the certificate and key in a modified format.   See  #1201\r\n2. The application does not run as root.  Thus, we need to make a copy of the certificate only readable by the user as which the application is running.  This is the case for `inspircd`."}}