# Run commands after SSL cert renewal **URL:** \ **Category:** Virtualmin\ **Created:** [January 5, 2025, 2:36pm UTC](https://forum.virtualmin.com/t/run-commands-after-ssl-cert-renewal/131430 "2025-01-05T14:36:18Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![lawk](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/l/dbc845/32.png) [@lawk](https://forum.virtualmin.com/u/lawk)\ **Post date:** [January 5, 2025, 2:36pm UTC](https://forum.virtualmin.com/t/run-commands-after-ssl-cert-renewal/131430/1 "2025-01-05T14:36:18Z")
Hello! I run DNS over TLS for BIND. BIND uses one of the certficates of a virtualmin domain. by default BIND cannot read these certificates because of a permissions issue. And thus BIND will fail to start. I fix it with these commands: ```auto setfacl -R -m u:named:rX /etc/letsencrypt/{live,archive}/ setfacl -m u:named:rX /etc/letsencrypt/{live,archive} ``` Can I use `certbot renew --deploy-hook` for this or do I need to use something virtualmin specific? I want to have a script that runs those commands after renewal. Or how can I set permissions for those folders and certs be persistent? ---
**Author:** ![Joe](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/joe/32/9_2.png) [@Joe](https://forum.virtualmin.com/u/Joe)\ **Post date:** [January 5, 2025, 5:55pm UTC](https://forum.virtualmin.com/t/run-commands-after-ssl-cert-renewal/131430/2 "2025-01-05T17:55:01Z")
> [@lawk](#): > > Can I use `certbot renew --deploy-hook` for this or do I need to use something virtualmin specific? You cannot use `certbot` directly for certificate management if Virtualmin is managing your certs. See this discussion of the same question: [Custom actions with Virtualmin's Letsencypt renewals? - #2 by Joe](https://forum.virtualmin.com/t/custom-actions-with-virtualmins-letsencypt-renewals/131248/2) ---
**Author:** ![lawk](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/l/dbc845/32.png) [@lawk](https://forum.virtualmin.com/u/lawk)\ **Post date:** [January 5, 2025, 6:51pm UTC](https://forum.virtualmin.com/t/run-commands-after-ssl-cert-renewal/131430/3 "2025-01-05T18:51:19Z")
So like this? ```auto if ["$VIRTUALSERVER_ACTION" = "SSL_DOMAIN"]; then setfacl -R -m u:named:rX /etc/letsencrypt/{live,archive}/ setfacl -m u:named:rX /etc/letsencrypt/{live,archive} fi ``` If so where do I put this? ---
**Author:** ![Joe](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/joe/32/9_2.png) [@Joe](https://forum.virtualmin.com/u/Joe)\ **Post date:** [January 5, 2025, 6:57pm UTC](https://forum.virtualmin.com/t/run-commands-after-ssl-cert-renewal/131430/4 "2025-01-05T18:57:46Z")
I answered that question in that thread, too. [Custom actions with Virtualmin's Letsencypt renewals? - #4 by Joe](https://forum.virtualmin.com/t/custom-actions-with-virtualmins-letsencypt-renewals/131248/4) It doesn’t matter where you put it, as long as Virtualmin has the full path to find it in the command to run field. I usually put this kind of thing in `/usr/local/bin` or `/usr/local/sbin`, but it doesn’t matter as long as you tell Virtualmin where to find it. ---
**Author:** ![lawk](https://cdn.forum.virtualmin.com/letter_avatar_proxy/v4/letter/l/dbc845/32.png) [@lawk](https://forum.virtualmin.com/u/lawk)\ **Post date:** [January 5, 2025, 7:26pm UTC](https://forum.virtualmin.com/t/run-commands-after-ssl-cert-renewal/131430/5 "2025-01-05T19:26:06Z")
So now I created: ```auto #!/bin/bash if ["$VIRTUALSERVER_ACTION" = "SSL_DOMAIN"]; then setfacl -R -m u:named:rX /etc/letsencrypt/{live,archive}/ setfacl -m u:named:rX /etc/letsencrypt/{live,archive} fi ``` and chmod +x namedpermissions.sh and put the path in `Command to run after making changes to a server` Does it know that `VIRTUALSERVER_ACTION" = "SSL_DOMAIN` is in reference to itself? In other words does it know that the command refers to itself for something that it was doing previously? which is the whole point I guess. This is a bit over my head, maybe I will just run a cron. ---
**Author:** ![Joe](https://cdn.forum.virtualmin.com/user_avatar/forum.virtualmin.com/joe/32/9_2.png) [@Joe](https://forum.virtualmin.com/u/Joe)\ **Post date:** [January 5, 2025, 9:15pm UTC](https://forum.virtualmin.com/t/run-commands-after-ssl-cert-renewal/131430/6 "2025-01-05T21:15:51Z")
> [@lawk](#): > > Does it know that `VIRTUALSERVER_ACTION" = "SSL_DOMAIN` is in reference to itself? In other words does it know that the command refers to itself for something that it was doing previously? which is the whole point I guess. I don’t think I understand what you mean. That is a variable that is set by Virtualmin before it runs any command that has been configured to run. As discussed in that thread, when a certificate is renewed, the variable will be set to `SSL_DOMAIN`, and when a new domain is created it will be set to `CREATE_DOMAIN`, etc. A script like this won’t do anything if called without that variable set (as it will never satisfy the test condition of being equal to `SSL_DOMAIN`, as it will be empty). ---
**Author:** ![system](https://cdn.forum.virtualmin.com/uploads/default/original/2X/c/cd96d761e326db4b2bef94886a639109bd7a8e76.svg) [@system](https://forum.virtualmin.com/u/system)\ **Post date:** [March 6, 2025, 9:16pm UTC](https://forum.virtualmin.com/t/run-commands-after-ssl-cert-renewal/131430/7 "2025-03-06T21:16:28Z")
Closed on March 6, 2025, 9:16pm UTC This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.