On ubuntu-server and apache.
How do I put LE in cron when it requires sudo to work?

I don’t know if there’s something wrong with my setup, but I can’t run LE as pure root. It fails every time. Says something about some module _struct is missing. It runs perfectly fine as a regular user with sudo. Put lots of stuff in the cli.ini, so it runs completely without interaction, after sudo authorisation.

depending on your sudoers file you can put everything into a script (like the one from @mikeskril ) and add the following line to your cron (e.g. /etc/cron.d/local)

0 0 1 * * <youruser> /usr/bin/sudo <your-script>
What I highly suggest, is that you don’t use the generated certificate directly. What I do is to copy the generated certificate to something like mycert.pem. and then create a symlink to the current certificate and then point my nginx config to that symlink. In case something is wrong with the certificate I can roll-back to a valid one (as I renew my certificates every 30 days).
Also you should always monitor the state of your certificates. I created a little program that does that and shows you a simple webpage: https://github.com/drtoful/certinel You put this on your local machine and let it run there and check on the page from time to time, as it checks every 5 minutes and updates the page automatically. There’s also a command line utility https://github.com/srvrco/checkssl that does the same, but a.f.a.i.k. it’s a one-shot test.
              
Hmm, that seems to have failed.
Dec  8 10:15:01 user sudo: pam_unix(sudo:auth): conversation failed

Dec  8 10:15:01 user sudo: pam_unix(sudo:auth): auth could not identify password for [user]
My username replaced with “user”.
              
@NoSubstitute, keep in mind that file /etc/sudoers should be configured to allow your user to run that command with sudo (and to run that command unattended it should be configured to not require password).
To do that, edit sudoers file, as root you should run this command visudo and put a line like this into that file (change youruser and the path to the command):

youruser ALL=(root) NOPASSWD:/path/to/the/command
Cheers,

sahsanu
              
if you have luck (depending on distro and stuff) you can lock a user with passwd -l 

depending on whether your systems still stores passwords in the passwd or in the shadow it’s a little bit different, but fist you need to create a “normal” user as usual and then there’s the main point. go into the pass or shadow file and replace the password hash with somehing that cant be a hash (for example put an ! before it (that’s what the command above does according to a website) so any password matching fails.
the account can still be accessed by means that dont need a password, for example going into it by using su from root or using public key auth if that is configured.
              
I wrote a blog post about my setup using the webroot method for renewals: https://www.bytopia.dk/blog/2015/11/09/automatic-renewal-of-lets-encrypt-issued-certificates/
Basically I use the following script to renew all letsencrypt certificates when they are about to expire in 4 weeks:
#!/bin/bash
if [ ! -d /etc/letsencrypt/live ]; then
  exit 1
function issueCert {
  /root/.local/share/letsencrypt/bin/letsencrypt certonly --renew-by-default --agree-dev-preview --server https://acme-v01.api.letsencrypt.org/directory --authenticator webroot --webroot-path /var/www/acme $1
exitcode=1
while IFS= read -r -d '' cert; do
  if ! openssl x509 -noout -checkend $((4*7*86400)) -in "${cert}"; then
    subject="$(openssl x509 -noout -subject -in "${cert}" | grep -o -E 'CN=[^ ,]+' | tr -d 'CN=')"
    subjectaltnames="$(openssl x509 -noout -text -in "${cert}" | sed -n '/X509v3 Subject Alternative Name/{n;p}' | sed 's/\s//g' | tr -d 'DNS:' | sed 's/,/ /g')"
    domains="-d ${subject}"
    for name in ${subjectaltnames}; do
      if [ "${name}" != "${subject}" ]; then
        domains="${domains} -d ${name}"
    issueCert "${domains}"
    exitcode=0
done < <(find /etc/letsencrypt/live -name cert.pem -print0)
exit ${exitcode}
If your user is foo and you have the letsencrypt-auto command for example in /home/foo/letsencrypt/letsencrypt-auto you should put in sudoers the path to letsencrypt (not letsencrypt-auto) command that should be located here /home/foo/.local/share/letsencrypt/bin/letsencrypt
So the line in sudoers file should be something like this:

foo ALL=(root) NOPASSWD:/home/foo/.local/share/letsencrypt/bin/letsencrypt
Now, as your foo user you can execute letsencrypt-auto command and it will take care to call to letsencrypt with sudo or you can directly execute sudo letsencrypt command.
Cheers,

sahsanu
authenticator = webroot

webroot-path = /var/www/example/

server = https://acme-v01.api.letsencrypt.org/directory

email = [email protected]

text = True

agree-tos = True

renew-by-default = True

now command line: crontab -e

@monthly /root/letsencrypt/letsencrypt-auto --config /etc/letsencrypt/cli.ini -d example.com -d www.example.com -d somestuff.example.com certonly && service nginx reload

save for && nginx reload i use /pathto/pathto/nginx/sbin/nginx -s reload -c /pathto/pathto/nginx/conf/nginx.conf

pathto=find your path use only if nginx is not a service
these steps are helping me! hope you too…thanks to the folks here!

IMPORTANT NOTES:
Congratulations! Your certificate and chain have been saved at

/etc/letsencrypt/live/example/fullchain.pem. Your cert will

expire on 2016-03-07. To obtain a new version of the certificate in

the future, simply run Let’s Encrypt again.
sorry for my english
              
I can’t run LE in any account but the one I commonly use! Can’t run as root, and can’t run as newly created le-user. Python fails with
ImportError: No module named _struct
So I can’t, so far, use this idea of a sudo user not needing a password to run LE.
              
You might want to take a look a the script I have created for updating my certificates.( Please note: probably very alpha)
The script should implement the following features:
works with nginx, but can easily altered to work with any other web server,
works with multiple certificates,
treats each certificate individually,
can be run daily without taking any action without cause,
restarts the web server only once even if multiple certificate shave been updated,
suitable for unattended usage as often as you like,
should request new certificate when expiry of the present one comes closer than an configurable amount of days,
expiry date is read from the certificate,
if request fails for some reason, the next run retries.
I did upload it on github: https://github.com/myprs/lenc-update
There is also some rudimentary documentation.
              
Please excuse the dumb question - I’m a beginner with these things:
Would it make sense to setup a LE cronjob with a non root shared hosting? That is not possible, right? How I understand it, the cronjob takes care about the cert renewal process. But it would require the LE client on the server (?)
As I generate my certs locally (I have to, bc no root access with my hosting plan), I can’t use cronjobs (although, I’m free to setup one cronjob with my hosting plan) to automatically renew them - correct?
              
More or less correct. You don’t have to be root if you use one of the third-party clients. If you can add files to the web root and replace the certificate information with the user that the cronjob uses, then you have all the access you need.
If you have to use a control panel interface to update/add the certificate information, a fully automated solution isn’t really feasible at this time without a bunch of special coding on your remove system.