Hi Everyone,

    We are trying to prepare for the eventual 90 certificate renewal mandate that is coming and wanted to see what others are doing to automate their TLS/SSL certificates on AIX. Our Linux servers can leverage Certbot, but that doesn't look pleasant to compile on AIX (or is it?). I see that acme.sh might be a possibility and maybe even just using pure bash or python since our CA has an API we can use. 

   What do you all use/recommend for doing automated certificate renewals? Anyone out there with some lessons learned from doing this?

Many thanks for any input! 

-Robert

------------------------------
Robert Johnson
------------------------------

Hi Robert,

Install python3.9 and python3-cryptography packages on your AIX box:

dnf -y install python3-cryptography

Create a virtual environment for certbot and copy system packages into it:

/opt/freeware/bin/python3 -mvenv /path/to/certbot --system-site-packages

Start bash and activate the environment:

ksh# bashbash$ source /path/to/certbot/bin/activate

Install pyOpenSSL 17.5.0:

pip3 install pyopenssl==17.5.0

Install certbot:

pip3 install certbot

Now you can use certbot without activating the python environment:

# /path/to/certbot/bin/certbot --versioncertbot 2.10.0# /path/to/certbot/bin/certbot --help   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

I hope it helps.

Hi Everyone,

    We are trying to prepare for the eventual 90 certificate renewal mandate that is coming and wanted to see what others are doing to automate their TLS/SSL certificates on AIX. Our Linux servers can leverage Certbot, but that doesn't look pleasant to compile on AIX (or is it?). I see that acme.sh might be a possibility and maybe even just using pure bash or python since our CA has an API we can use. 

   What do you all use/recommend for doing automated certificate renewals? Anyone out there with some lessons learned from doing this?

Many thanks for any input! 

-Robert

------------------------------
Robert Johnson
------------------------------

Hi Robert,

Install python3.9 and python3-cryptography packages on your AIX box:

dnf -y install python3-cryptography

Create a virtual environment for certbot and copy system packages into it:

/opt/freeware/bin/python3 -mvenv /path/to/certbot --system-site-packages

Start bash and activate the environment:

ksh# bashbash$ source /path/to/certbot/bin/activate

Install pyOpenSSL 17.5.0:

pip3 install pyopenssl==17.5.0

Install certbot:

pip3 install certbot

Now you can use certbot without activating the python environment:

# /path/to/certbot/bin/certbot --versioncertbot 2.10.0# /path/to/certbot/bin/certbot --help   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

I hope it helps.

Hi Everyone,

    We are trying to prepare for the eventual 90 certificate renewal mandate that is coming and wanted to see what others are doing to automate their TLS/SSL certificates on AIX. Our Linux servers can leverage Certbot, but that doesn't look pleasant to compile on AIX (or is it?). I see that acme.sh might be a possibility and maybe even just using pure bash or python since our CA has an API we can use. 

   What do you all use/recommend for doing automated certificate renewals? Anyone out there with some lessons learned from doing this?

Many thanks for any input! 

-Robert

------------------------------
Robert Johnson
------------------------------

Andrey, Thanks for the directions. I gave this a try and hit a snag running the "pip3 install certbot" step. I tried on both 7.2 and 7.3 running against a repo that was updated on 2024-05-20.

The pip3 command fails with the following error. Any suggestions?

------------------------------
Mike AIX

Original Message:
Sent: Tue May 14, 2024 06:58 AM
From: Andrey Klyachkin
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Robert,

Install python3.9 and python3-cryptography packages on your AIX box:

dnf -y install python3-cryptography

Create a virtual environment for certbot and copy system packages into it:

/opt/freeware/bin/python3 -mvenv /path/to/certbot --system-site-packages

Start bash and activate the environment:

ksh# bashbash$ source /path/to/certbot/bin/activate

Install pyOpenSSL 17.5.0:

pip3 install pyopenssl==17.5.0

Install certbot:

pip3 install certbot

Now you can use certbot without activating the python environment:

# /path/to/certbot/bin/certbot --versioncertbot 2.10.0# /path/to/certbot/bin/certbot --help   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

I hope it helps.

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Mon May 13, 2024 04:11 PM
From: Robert Johnson
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Everyone,

    We are trying to prepare for the eventual 90 certificate renewal mandate that is coming and wanted to see what others are doing to automate their TLS/SSL certificates on AIX. Our Linux servers can leverage Certbot, but that doesn't look pleasant to compile on AIX (or is it?). I see that acme.sh might be a possibility and maybe even just using pure bash or python since our CA has an API we can use. 

   What do you all use/recommend for doing automated certificate renewals? Anyone out there with some lessons learned from doing this?

Many thanks for any input! 

-Robert

------------------------------
Robert Johnson
------------------------------

Hi Mike,

the post was written one year ago and the actual version of certbot was 2.10.0.

One year later the actual version of certbot is 4.1.1. Even if the documentation says that the minimum supported Python version is 3.9.2, I don't think it is actual.

You can try either to use newer Python 3.11 or to use older certbot like pip3 install certbot==2.10.0

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Tue July 15, 2025 03:49 PM
From: Mike Peterson
Subject: TLS Certificate renewal automation on AIX 7.2

Andrey, Thanks for the directions. I gave this a try and hit a snag running the "pip3 install certbot" step. I tried on both 7.2 and 7.3 running against a repo that was updated on 2024-05-20.

The pip3 command fails with the following error. Any suggestions?

------------------------------
Mike AIX

Original Message:
Sent: Tue May 14, 2024 06:58 AM
From: Andrey Klyachkin
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Robert,

Install python3.9 and python3-cryptography packages on your AIX box:

dnf -y install python3-cryptography

Create a virtual environment for certbot and copy system packages into it:

/opt/freeware/bin/python3 -mvenv /path/to/certbot --system-site-packages

Start bash and activate the environment:

ksh# bashbash$ source /path/to/certbot/bin/activate

Install pyOpenSSL 17.5.0:

pip3 install pyopenssl==17.5.0

Install certbot:

pip3 install certbot

Now you can use certbot without activating the python environment:

# /path/to/certbot/bin/certbot --versioncertbot 2.10.0# /path/to/certbot/bin/certbot --help   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

I hope it helps.

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Mon May 13, 2024 04:11 PM
From: Robert Johnson
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Everyone,

    We are trying to prepare for the eventual 90 certificate renewal mandate that is coming and wanted to see what others are doing to automate their TLS/SSL certificates on AIX. Our Linux servers can leverage Certbot, but that doesn't look pleasant to compile on AIX (or is it?). I see that acme.sh might be a possibility and maybe even just using pure bash or python since our CA has an API we can use. 

   What do you all use/recommend for doing automated certificate renewals? Anyone out there with some lessons learned from doing this?

Many thanks for any input! 

-Robert

------------------------------
Robert Johnson
------------------------------

Thanks for the quick reply Andrey. 

I'd prefer to use the newer version of certbot if that is an option. I'm happy to follow some other documentation or steps if you have them. 

Considering the first option you provided, I don't see a python 3.11 available via the aixtoolbox. Following the other option, updated to the latest RPMs available from IBM and started over with the direction you provided above (I first deleted the '/path/to/certbot/' directory), including the change to set certbot=2.10.0.  All the commands seemed to execute fine but running certbot --version gave the following errors:

Hi Mike,

the post was written one year ago and the actual version of certbot was 2.10.0.

One year later the actual version of certbot is 4.1.1. Even if the documentation says that the minimum supported Python version is 3.9.2, I don't think it is actual.

You can try either to use newer Python 3.11 or to use older certbot like pip3 install certbot==2.10.0

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Tue July 15, 2025 03:49 PM
From: Mike Peterson
Subject: TLS Certificate renewal automation on AIX 7.2

Andrey, Thanks for the directions. I gave this a try and hit a snag running the "pip3 install certbot" step. I tried on both 7.2 and 7.3 running against a repo that was updated on 2024-05-20.

The pip3 command fails with the following error. Any suggestions?

------------------------------
Mike AIX

Original Message:
Sent: Tue May 14, 2024 06:58 AM
From: Andrey Klyachkin
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Robert,

Install python3.9 and python3-cryptography packages on your AIX box:

dnf -y install python3-cryptography

Create a virtual environment for certbot and copy system packages into it:

/opt/freeware/bin/python3 -mvenv /path/to/certbot --system-site-packages

Start bash and activate the environment:

ksh# bashbash$ source /path/to/certbot/bin/activate

Install pyOpenSSL 17.5.0:

pip3 install pyopenssl==17.5.0

Install certbot:

pip3 install certbot

Now you can use certbot without activating the python environment:

# /path/to/certbot/bin/certbot --versioncertbot 2.10.0# /path/to/certbot/bin/certbot --help   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

I hope it helps.

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Mon May 13, 2024 04:11 PM
From: Robert Johnson
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Everyone,

    We are trying to prepare for the eventual 90 certificate renewal mandate that is coming and wanted to see what others are doing to automate their TLS/SSL certificates on AIX. Our Linux servers can leverage Certbot, but that doesn't look pleasant to compile on AIX (or is it?). I see that acme.sh might be a possibility and maybe even just using pure bash or python since our CA has an API we can use. 

   What do you all use/recommend for doing automated certificate renewals? Anyone out there with some lessons learned from doing this?

Many thanks for any input! 

-Robert

------------------------------
Robert Johnson
------------------------------

Sorry, I simply missed the python3.11 packages. Trying that, I don't get as far:

# rm -rf /tmp/certbot
# rpm -qa | grep python3.11
python3.11-3.11.9-1.ppc
python3.11-pip-23.3.1-1.noarch
# /usr/opt/python3/bin/python3.11 -mvenv /tmp/certbot --system-site-packages
Error: Command '['/tmp/certbot/bin/python3.11', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

Thanks for the quick reply Andrey. 

I'd prefer to use the newer version of certbot if that is an option. I'm happy to follow some other documentation or steps if you have them. 

Considering the first option you provided, I don't see a python 3.11 available via the aixtoolbox. Following the other option, updated to the latest RPMs available from IBM and started over with the direction you provided above (I first deleted the '/path/to/certbot/' directory), including the change to set certbot=2.10.0.  All the commands seemed to execute fine but running certbot --version gave the following errors:

Hi Mike,

the post was written one year ago and the actual version of certbot was 2.10.0.

One year later the actual version of certbot is 4.1.1. Even if the documentation says that the minimum supported Python version is 3.9.2, I don't think it is actual.

You can try either to use newer Python 3.11 or to use older certbot like pip3 install certbot==2.10.0

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Tue July 15, 2025 03:49 PM
From: Mike Peterson
Subject: TLS Certificate renewal automation on AIX 7.2

Andrey, Thanks for the directions. I gave this a try and hit a snag running the "pip3 install certbot" step. I tried on both 7.2 and 7.3 running against a repo that was updated on 2024-05-20.

The pip3 command fails with the following error. Any suggestions?

------------------------------
Mike AIX

Original Message:
Sent: Tue May 14, 2024 06:58 AM
From: Andrey Klyachkin
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Robert,

Install python3.9 and python3-cryptography packages on your AIX box:

dnf -y install python3-cryptography

Create a virtual environment for certbot and copy system packages into it:

/opt/freeware/bin/python3 -mvenv /path/to/certbot --system-site-packages

Start bash and activate the environment:

ksh# bashbash$ source /path/to/certbot/bin/activate

Install pyOpenSSL 17.5.0:

pip3 install pyopenssl==17.5.0

Install certbot:

pip3 install certbot

Now you can use certbot without activating the python environment:

# /path/to/certbot/bin/certbot --versioncertbot 2.10.0# /path/to/certbot/bin/certbot --help   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

I hope it helps.

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Mon May 13, 2024 04:11 PM
From: Robert Johnson
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Everyone,

    We are trying to prepare for the eventual 90 certificate renewal mandate that is coming and wanted to see what others are doing to automate their TLS/SSL certificates on AIX. Our Linux servers can leverage Certbot, but that doesn't look pleasant to compile on AIX (or is it?). I see that acme.sh might be a possibility and maybe even just using pure bash or python since our CA has an API we can use. 

   What do you all use/recommend for doing automated certificate renewals? Anyone out there with some lessons learned from doing this?

Many thanks for any input! 

-Robert

------------------------------
Robert Johnson
------------------------------

Hi Mike,

I just checked on one of my servers.

Python 3.11 will not work unfortunately. There is no python3.11-cryptography package and it is required for certbot.

The latest version of certbot installs on Python 3.9 without any real problem. I executed exactly the commands I wrote above and everything worked like a charm.

I've got some stupid warning, but certbot is there.

Your error message (with certbot on Python 3.9) says, that you have some problem with josepy package. Check with pip3 list inside the virtual environment, which version of the package you have. As for me it is josepy 2.1.0.

Looking at your first error from yesterday, it looks like you forgot to install cryptography package. This is the only place where rust compiler is required.

Sorry, I simply missed the python3.11 packages. Trying that, I don't get as far:

# rm -rf /tmp/certbot
# rpm -qa | grep python3.11
python3.11-3.11.9-1.ppc
python3.11-pip-23.3.1-1.noarch
# /usr/opt/python3/bin/python3.11 -mvenv /tmp/certbot --system-site-packages
Error: Command '['/tmp/certbot/bin/python3.11', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

Thanks for the quick reply Andrey. 

I'd prefer to use the newer version of certbot if that is an option. I'm happy to follow some other documentation or steps if you have them. 

Considering the first option you provided, I don't see a python 3.11 available via the aixtoolbox. Following the other option, updated to the latest RPMs available from IBM and started over with the direction you provided above (I first deleted the '/path/to/certbot/' directory), including the change to set certbot=2.10.0.  All the commands seemed to execute fine but running certbot --version gave the following errors:

Hi Mike,

the post was written one year ago and the actual version of certbot was 2.10.0.

One year later the actual version of certbot is 4.1.1. Even if the documentation says that the minimum supported Python version is 3.9.2, I don't think it is actual.

You can try either to use newer Python 3.11 or to use older certbot like pip3 install certbot==2.10.0

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Tue July 15, 2025 03:49 PM
From: Mike Peterson
Subject: TLS Certificate renewal automation on AIX 7.2

Andrey, Thanks for the directions. I gave this a try and hit a snag running the "pip3 install certbot" step. I tried on both 7.2 and 7.3 running against a repo that was updated on 2024-05-20.

The pip3 command fails with the following error. Any suggestions?

------------------------------
Mike AIX

Original Message:
Sent: Tue May 14, 2024 06:58 AM
From: Andrey Klyachkin
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Robert,

Install python3.9 and python3-cryptography packages on your AIX box:

dnf -y install python3-cryptography

Create a virtual environment for certbot and copy system packages into it:

/opt/freeware/bin/python3 -mvenv /path/to/certbot --system-site-packages

Start bash and activate the environment:

ksh# bashbash$ source /path/to/certbot/bin/activate

Install pyOpenSSL 17.5.0:

pip3 install pyopenssl==17.5.0

Install certbot:

pip3 install certbot

Now you can use certbot without activating the python environment:

# /path/to/certbot/bin/certbot --versioncertbot 2.10.0# /path/to/certbot/bin/certbot --help   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

I hope it helps.

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Mon May 13, 2024 04:11 PM
From: Robert Johnson
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Everyone,

    We are trying to prepare for the eventual 90 certificate renewal mandate that is coming and wanted to see what others are doing to automate their TLS/SSL certificates on AIX. Our Linux servers can leverage Certbot, but that doesn't look pleasant to compile on AIX (or is it?). I see that acme.sh might be a possibility and maybe even just using pure bash or python since our CA has an API we can use. 

   What do you all use/recommend for doing automated certificate renewals? Anyone out there with some lessons learned from doing this?

Many thanks for any input! 

-Robert

------------------------------
Robert Johnson
------------------------------

Thanks again for the quick replies. I tried again with a clean /tmp/certbot directory. The pip3 josepy package appears to be 2.1.0 but I still get failures. AIX here is 7200-05-07 but I've gotten the same result on 7300-03-00.  The lpp openssl package is 3.0.13.1000. 

Hi Mike,

I just checked on one of my servers.

Python 3.11 will not work unfortunately. There is no python3.11-cryptography package and it is required for certbot.

The latest version of certbot installs on Python 3.9 without any real problem. I executed exactly the commands I wrote above and everything worked like a charm.

I've got some stupid warning, but certbot is there.

Your error message (with certbot on Python 3.9) says, that you have some problem with josepy package. Check with pip3 list inside the virtual environment, which version of the package you have. As for me it is josepy 2.1.0.

Looking at your first error from yesterday, it looks like you forgot to install cryptography package. This is the only place where rust compiler is required.

Sorry, I simply missed the python3.11 packages. Trying that, I don't get as far:

# rm -rf /tmp/certbot
# rpm -qa | grep python3.11
python3.11-3.11.9-1.ppc
python3.11-pip-23.3.1-1.noarch
# /usr/opt/python3/bin/python3.11 -mvenv /tmp/certbot --system-site-packages
Error: Command '['/tmp/certbot/bin/python3.11', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

Thanks for the quick reply Andrey. 

I'd prefer to use the newer version of certbot if that is an option. I'm happy to follow some other documentation or steps if you have them. 

Considering the first option you provided, I don't see a python 3.11 available via the aixtoolbox. Following the other option, updated to the latest RPMs available from IBM and started over with the direction you provided above (I first deleted the '/path/to/certbot/' directory), including the change to set certbot=2.10.0.  All the commands seemed to execute fine but running certbot --version gave the following errors:

Hi Mike,

the post was written one year ago and the actual version of certbot was 2.10.0.

One year later the actual version of certbot is 4.1.1. Even if the documentation says that the minimum supported Python version is 3.9.2, I don't think it is actual.

You can try either to use newer Python 3.11 or to use older certbot like pip3 install certbot==2.10.0

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Tue July 15, 2025 03:49 PM
From: Mike Peterson
Subject: TLS Certificate renewal automation on AIX 7.2

Andrey, Thanks for the directions. I gave this a try and hit a snag running the "pip3 install certbot" step. I tried on both 7.2 and 7.3 running against a repo that was updated on 2024-05-20.

The pip3 command fails with the following error. Any suggestions?

------------------------------
Mike AIX

Original Message:
Sent: Tue May 14, 2024 06:58 AM
From: Andrey Klyachkin
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Robert,

Install python3.9 and python3-cryptography packages on your AIX box:

dnf -y install python3-cryptography

Create a virtual environment for certbot and copy system packages into it:

/opt/freeware/bin/python3 -mvenv /path/to/certbot --system-site-packages

Start bash and activate the environment:

ksh# bashbash$ source /path/to/certbot/bin/activate

Install pyOpenSSL 17.5.0:

pip3 install pyopenssl==17.5.0

Install certbot:

pip3 install certbot

Now you can use certbot without activating the python environment:

# /path/to/certbot/bin/certbot --versioncertbot 2.10.0# /path/to/certbot/bin/certbot --help   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

I hope it helps.

------------------------------
Andrey Klyachkin

https://www.power-devops.com

Original Message:
Sent: Mon May 13, 2024 04:11 PM
From: Robert Johnson
Subject: TLS Certificate renewal automation on AIX 7.2

Hi Everyone,

    We are trying to prepare for the eventual 90 certificate renewal mandate that is coming and wanted to see what others are doing to automate their TLS/SSL certificates on AIX. Our Linux servers can leverage Certbot, but that doesn't look pleasant to compile on AIX (or is it?). I see that acme.sh might be a possibility and maybe even just using pure bash or python since our CA has an API we can use. 

   What do you all use/recommend for doing automated certificate renewals? Anyone out there with some lessons learned from doing this?

Many thanks for any input! 

-Robert

------------------------------
Robert Johnson
------------------------------