opened
Daniel15
username_0
`certbot --help certonly` does not explain that the `--deploy-hook` function can be used to run a deploy hook after issuing the certificate, and that it **also** configures the hook to run on renewals too (by adding it to `/etc/letsencrypt/renewal/example.com.conf` as a `renew_hook` option). This is very useful to know.
--deploy-hook not documented in certbot certonly docs
issue
created
joohoi
username_1
Thanks for opening the issue! 

You are right, and we actually have even more hook functionality baked in. There's a longish description of them in [certbot documentation](https://certbot.eff.org/docs/using.html#renewing-certificates). I believe the preferred way of handling the hooks is the hook directories in `/etc/letsencrypt/renewal-hooks` to give better visibility for users what's running and when. I'll bring your point up for discussion with the team.
comment
created
joohoi
username_1
You can check the certificate within the deploy hook script by using the environment variables `RENEWED_DOMAINS` or `RENEWED_LINEAGE` populated by Certbot to single out the certificate you want to act upon.
comment
created
GrahamH68
username_2
Are scripts in the deploy directory meant to be called on first creation of a certificate when using CERTONLY with DNS01 ?

I have a simple script to echo out the contents of RENEWED_LINEAGE and RENEWED_DOMAINS, but it doesn't see to be called when a certificate is created.
comment
created
mohag
username_3
To me it feels as if it might make to not add the `--deploy-hook` value to the config file (especially in the undocumented state). Keeping the `--renew-hook` option (at least on `certonly` and `run` seems like it might result in less unexpected behaviour) (I want to use `--deploy-hook` for a script that installs the certificate initially and it might not be safe to run multiple times...) (e..g append certificate options with filenames at the end of a configuration file)

(If not this, some other way of separating installation and renewal hooks does seem useful for these reasons...)
comment
created
mssaisandeep
username_4
I am facing the same issue, Running deploy hook for the cert generation will be called sometimes and may not be called sometimes. So is there any hook that I can use for every successful certificate generation(generating/renewal)?? 

BTW if I use certbot certonly --deploy-hook, then that --deploy-hook is getting converted to --renewal-hook in /etc/letsencrypt/renewal/<domainaname>.conf file. 

Please help me.
comment
created
lonix1
username_5
Has anyone found the answer?

I also want to have a hook run after *cert creation*, but they only reliably run after *cert renewal*.
comment
created
bmw
username_6
@username_5, you may also find my previous response useful, but the approach you have taken here will cause that script to be run whenever a certificate is issued with any subcommand. If that's the behavior you want, you're good to go!
comment
created
mohag
username_3
Documentation page still does not list it under certonly
comment