Bug? report: /etc/letsencrypt/csr growing big

Virtualmin
1
SYSTEM INFORMATION
OS type and version Ubuntu 20.04/24.04
Webmin version 2.303
Virtualmin version 7.30.8 Pro
Webserver version Apache 2.4.41

it looks like all site folders inside /etc/letsencrypt/csr never get cleaned, and the directory is growing big, some servers well over a gigabyte.

2

With the accelerated renewal process this will only get worse.

image
image784×903 124 KB

3

@Ilia could you give us a suggestion on “cleanup” for this folder??

4

Yes, sure, you can clean up some of its files by running:

find /etc/letsencrypt/csr/ -type f -mtime +90 -delete
5

Thank you @Ilia , but may I suggest that Virtualmin does that whenever it renews a Let’sEncrypt certificate, at least inside the sub-folder for which it renewed it ?

6

As an OS package I’d think this should be handled ‘upstream’?

7

I am fine with whatever solution as long as it’s handled by Virtualmin (Pro) or its packages, or the API of the packages. Maybe it’s a bug of the package, either to be fixed by the package or worked around. It’s nothing urgent, fix can wait a few months, so you can sure try by first filing a bug upstream, and if nothing happens workaround, as usual. :wink:

8

I’m not sure about that
 @Jamie, what are your thoughts on it?

9

I assume that the certbot tool is what creates files in /etc/letsencrypt/csr , since Virtualmin never touches that directory. We could clean it up, but also I’d feel a little scared messing with another program’s database.

3 Likes
10

Problem is, obviously, you are ‘ass u me’ ing these are stale files because people are renewing regularly.

This is about as much help as I can offer. :wink:

11

Just so the answer is here too.

"You should NOT use the ubuntu Certbot package. Instead you should use the snapd distribution. Certbot stopped supporting distributions in favor of snapd several years ago; their team recommends against using distribution packages because they are often seriously out of date and miss important fixes and updates.

you can delete the /csr/ files. they are only there for archives/backups and are not used for renewal."

12

Ilia, thanks for the script
 turns out I should’ve checked the size of my /etc/letsencrypt folder before asking
 my entire /etc/letsencrypt folder is only 51 meg. No need to clean up. It seems to be managing itself. (I use Debian, not Ubuntu)

13

I think LE is going to start recommending 3 week cert renewal. So, this might become more of an issue going forward. Ubuntu leeches off of Debian for packages, hence the ‘old’ unfixed version.

I have NO idea how snapd packages would differ but the good thing is that there is only ONE to worry about over all distributions.