It gives the full info when it works, but not when it doesn't!? (as it should).

TBH, I don't know why that's the case but there is a line in your logs that gives me some idea (albeit not real clarity on the issue). This is the line I'm talking about:

[2024-06-23 10:14:02] dehydrated-wrapper: FATAL: Unexpected challenge type:

Note the colon at the end. That's where the full dehydrated error log should appear. Obviously it's not...

As it's only failing when it's run from the cron job, I suspect that it's something related to the cron job itself. FYI cron jobs run in a limited environment so it seems likely that there is something missing from the cron env.

Out of interest, does the Let's Encrypt error occur within 24 hours of manually running it? I ask because beyond the cron env, there is another fundamental difference between running it manually and via cron.

When it's run manually, it will force update of the cert - regardless of when the current cert will expire. Via cron it should only attempt to update the cert if it expires in 30 days or less. New certs are valid for 90 days. Given that log line I quote above, if the cron failure happens within 24 hours of the manual update, then that's another unexpected and weird component of this problem.

TBH, it's a real mystery why no one else has reported the issue you're hitting. FWIW we're dogfooding our LE integration - this server uses the same Let's Encrypt process that you are. Although actually, perhaps your server is a different TurnKey version and/or has a different version of Confconsole? IIRC this site was actually built before I built the publicly released images.

Regardless, can you please confirm the TurnKey version of your server and the version of Confconsole it's running. Here's how to do that respectively:

turnkey-version
apt list confconsole

Re your suspicion that it's a $CTYPE issue, why do you think that? FYI if it's anything to do with the below message when installing/updating packages, then that's not an issue:

perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
	LANGUAGE = "en_US.UTF-8",
	LC_ALL = (unset),
	LC_TIME = "en_AU.utf8",
	LC_MONETARY = "en_AU.utf8",
	LC_CTYPE = "C",
	LC_COLLATE = "C",
	LC_MEASUREMENT = "en_AU.utf8",
	LC_NUMERIC = "en_AU.utf8",
	LC_PAPER = "en_AU.utf8",
	LANG = "en_US.UTF-8"
    are supported and installed on your system.
perl: warning: Falling back to a fallback locale ("en_US.UTF-8").
perl: warning: Setting locale failed.
perl: warning: Please check that your locale settings:
	LANGUAGE = "en_US.UTF-8",
	LC_ALL = (unset),
	LC_TIME = "en_AU.utf8",
	LC_CTYPE = "C",
	LC_MONETARY = "en_AU.utf8",
	LC_COLLATE = "C",
	LC_MEASUREMENT = "en_AU.utf8",
	LC_NUMERIC = "en_AU.utf8",
	LC_PAPER = "en_AU.utf8",
	LANG = "en_US.UTF-8"
    are supported and installed on your system.
perl: warning: Falling back to a fallback locale ("en_US.UTF-8").

FYI, I copied that from a local v18.0 LAMP server I have running. I have not changed any of those server side. (Some are propagating via SSH from my local PC,

Actually scratch that. Looks like my initial testing was poor... :( It seems this new version may have introduced a new regression **sigh**

I'll be back soon with another new build.

Thanks again for reporting the issue. I'm pretty confident I've fixed it, but it'd be great if you could test it to 100% confirm.

To download and install it (on your appliance):

# download
wget https://www.turnkeylinux.org/files/tmp/confconsole_2.1.5+2+g40d7d22_all.deb

# for extra security, check the sha512sum against what is posted below
sha512sum confconsole_2.1.5+2+g40d7d22_all.deb

# install
apt install ./confconsole_2.1.5+2+g40d7d22_all.deb

SHA sum:

e5aa2a31aa6e9d60e03a26aed05e260f1969294a7f1f819a81a89037c33318b01f87dc09a869b02887dbd313bf5fa8c99cd96a52883c865a5be8ca820f34423e

Look forward to hearing how you go. Assuming that we confirm it's good, I'll push it to the apt repo.

That'll teach me for getting ahead of myself... Anyway, I've tested this better. So please try this one:

# download
wget https://www.turnkeylinux.org/files/tmp/confconsole_2.1.5+5+g515d28d_all.deb

# for extra security, check the sha512sum against what is posted below
sha512sum confconsole_2.1.5+5+g515d28d_all.deb

# install
apt install ./confconsole_2.1.5+5+g515d28d_all.deb

SHA sum:

70cedcb717ff3eb872ce2e3d6b9c8f56fe4ef7f09abe32e5933fa2ebf4d9631f2058b8059f93df84ea9d4f81261078e1ca6e212cb934883b0aba656f01d69c4e

Look forward to hearing how your go.

FYI I finalised the new version of Confconsole (v2.1.6) last month and pushed to the TurnKey v18.x (Debian 12/Bookworm) repo.