i have resolved the issue added an another systemd service that will be executed after the execution of the carbonio-certbot.timer:

You have to create the file " removed link " with this content:

Description=Post-renew tasks for Carbonio
After=carbonio-certbot.service
Requires=carbonio-certbot.service


Type=oneshot
User=root
ExecStartPre=/bin/su -s /bin/bash zextras -c "/opt/zextras/libexec/zmproxyconfgen"
ExecStart=/bin/systemctl restart carbonio-proxy.target
ExecStartPost=/bin/systemctl restart carbonio-mta.target

After that you have to reload all systemd daemon with this command:

systemctl daemon-reload

And enable the service by typing:

systemctl enable carbonio-certbot-post.service

I have the installation that use systemd instead of the single file to manage each service.

I suppose that Carbonio Development team have to add this feature on the next update because if there is a timer to renew the certificate they have to deploy the certificate in the system too.

Best regards

You can automate the renewal of the Let's encrypt SSL certificate without any script. Please feel free to take a look at this segment of official documentation:

Let's Encrypt Automatic Renewal

Let us know how it goes!

ok I see that the renewal is working fine, but I dont really want to alway check up on the cert and SSH into the server to run the 

"

zextras$ /opt/zextras/libexec/zmproxyconfgen
zextras$ /opt/zextras/bin/zmproxyctl reload

"

is there a way to run this via post hook ? 

What is the recomended way so this just work.

Also what about certs for the MTA and such on imaps, pops , and 465, 587 ? 

Does that get replaced also ?

Thanks ! 

Thank you for your feedback, here is the result :

root@mail:~# certbot renew
Saving debug log to removed link

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing removed link
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Processing removed link
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
The following certificates are not due for renewal yet:
removed link expires on 2025-08-18 (skipped)
removed link expires on 2025-08-18 (skipped)
No renewals were attempted.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

This is letsencrypt.log : 

root@mail:~# cat removed link
2025-05-20 08:34:23,328:DEBUG:urllib3.connectionpool:http://localhost:None "GET /v2/connections?snap=certbot&interface=content HTTP removed link " 200 97
2025-05-20 08:34:23,468:DEBUG:certbot._internal.main:certbot version: 3.3.0
2025-05-20 08:34:23,468:DEBUG:certbot._internal.main:Location of certbot entry point: /snap/certbot/4482/bin/certbot
2025-05-20 08:34:23,468:DEBUG:certbot._internal.main:Arguments:
2025-05-20 08:34:23,468:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2025-05-20 08:34:23,480:DEBUG:certbot._internal.log:Root logging level set at 30
2025-05-20 08:34:23,481:DEBUG:certbot._internal.display.obj:Notifying user: Processing removed link
2025-05-20 08:34:23,482:DEBUG:certbot._internal.plugins.selection:Requested authenticator None and installer None
2025-05-20 08:34:23,489:INFO:certbot.ocsp:Cannot extract OCSP URI from removed link
2025-05-20 08:34:23,491:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2025-05-20 08:34:23,491:DEBUG:certbot._internal.plugins.selection:Requested authenticator standalone and installer None
2025-05-20 08:34:23,491:DEBUG:certbot._internal.display.obj:Notifying user: Processing removed link
2025-05-20 08:34:23,492:DEBUG:certbot._internal.plugins.selection:Requested authenticator None and installer None
2025-05-20 08:34:23,498:INFO:certbot.ocsp:Cannot extract OCSP URI from removed link
2025-05-20 08:34:23,499:DEBUG:certbot._internal.display.obj:Notifying user: Certificate not yet due for renewal
2025-05-20 08:34:23,499:DEBUG:certbot._internal.plugins.selection:Requested authenticator standalone and installer None
2025-05-20 08:34:23,499:DEBUG:certbot._internal.display.obj:Notifying user:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2025-05-20 08:34:23,499:DEBUG:certbot._internal.display.obj:Notifying user: The following certificates are not due for renewal yet:
2025-05-20 08:34:23,500:DEBUG:certbot._internal.display.obj:Notifying user: removed link expires on 2025-08-18 (skipped)
removed link expires on 2025-08-18 (skipped)
2025-05-20 08:34:23,500:DEBUG:certbot._internal.display.obj:Notifying user: No renewals were attempted.
2025-05-20 08:34:23,500:DEBUG:certbot._internal.display.obj:Notifying user: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2025-05-20 08:34:23,500:DEBUG:certbot._internal.renewal:no renewal failures

Thank you for your help.

You can automate the renewal of the Let's encrypt SSL certificate without any script. Please feel free to take a look at this segment of official documentation:

Let's Encrypt Automatic Renewal

Let us know how it goes!

I have following error regarding that script.

Virtual Hostnames set for all domains.
ERROR: account.NO_SUCH_SERVER (no such server: mail)
zimbraReverseProxyMailMode set to redirect.
Stopping proxy...done.
Starting proxy...done.
zmproxyctl restarted.
Saving debug log to removed link
Simulating a certificate request for mail.xxxxx.id

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: mail.xxxxxxxid
Type: connection
Detail: 103.163.161.xx: Fetching removed link : Connection refused

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Some challenges have failed.
Ask for help or search for solutions at removed link See the logfile removed link or re-run Certbot with -v for more details.
Certificate obtained for domain txxxxi.id
Saving debug log to removed link
Simulating a certificate request for mail.yyyyyyy.com

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: mail.yyyyy.com
Type: connection
Detail: 103.163.161.xxx: Fetching removed link : Connection refused

Any advice to resolve this ?

Thank you in advanced.

Configure your crontab to run this is often as you like but keep in mind you'll get an email every time it runs.  Better yet, use a real solution like zabbix or checkmk to monitor your certificates. 

Requirements: openssl and mailx

#!/bin/bash
# Check for the number of days left before certificate expiration and restart Zimbra
# if there are less than 15 days remaining on the certificate
# Taken from
# https://sleeplessbeastie.eu/2017/04/03/how-to-display-days-till-certificate-expiration/

# temporary file to store certificate
certificate_file=$(mktemp)
host="mail.sampledomain.xyz"
sender="admin@sampledomain.xyz"
recipient="admin@sampledomain.xyz"
now=`/usr/bin/date`

# delete temporary file on exit
trap "unlink $certificate_file" EXIT

echo -n | /usr/bin/openssl s_client -servername "$host" -connect "$host":443 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > $certificate_file
certificate_size=$(stat -c "%s" $certificate_file)
if ; then
  date=$(openssl x509 -in $certificate_file -enddate -noout | sed "s/.*=\(.*\)/\1/")
  date_s=$(date -d "${date}" +%s)
  now_s=$(date -d now +%s)
  date_diff=$(( (date_s - now_s) / 86400 ))
  if ; then
    echo "Certificate on $host has less than ${date_diff} days remaining, Check certbot renewal for errors" | /usr/bin/mail -a "From: $sender" -s "Domain Certificate Issue" $recipient # Certificate should have renewed by now
  else
    echo "SSL Certificate on $host has ${date_diff} days remaining, Nothing to do" | /usr/bin/mail -a "From: $sender" -s "Domain SSL Status OK" $recipient # ok
  fi
else
  echo "Error encountered processing certificate at ${now} on $host. Check Mailserver Status"  | /usr/bin/mail -a "From: $sender" -s "Mailserver Certificate Problem" $recipient
fi

Let’s Encrypt on Carbonio – Easy as never before