[Bug]: Verbose output from manual authenticator hook blocks cleanup hook from running at all
OS
Fedora 41
Installation method
pip
Certbot Version
5.6.0
What happened?
$ certbot renew
...but then I can see that the cleanup script was not run. From the relevant log output one can see it failed to run because of "Argument list too long". After some debugging, I found that the whole output of the authenticator script is fed to the cleanup script using the CERTBOT_AUTH_OUTPUT environment variable.. and because of the verbose nature of my authenticator script it just gets too big and the script fails to run.
Motivation: I tried commenting out the env['CERTBOT_AUTH_OUTPUT'] = out.strip() line in manual.py, after which the issue disappeared.
Expected behavior
It would be nice if the CERTBOT_AUTH_OUTPUT was truncated in case it is excessively big, in order not to block the cleanup script from running. In general, passing script output through environment variables is risky; a better approach would be to pass a filename containing the output instead.
Relevant log output
2026-06-30 15:51:12,185:INFO:certbot.compat.misc:Running manual-cleanup-hook command: /opt/letsencrypt/certbot/cleanup-hook
2026-06-30 15:51:12,190:ERROR:certbot._internal.error_handler:Encountered exception during recovery: OSError: [Errno 7] Argument list too long: '/bin/sh'
2026-06-30 15:51:12,191:ERROR:certbot._internal.renewal:Failed to renew certificate example.com with error: Some challenges have failed.
2026-06-30 15:51:12,202:DEBUG:certbot._internal.renewal:Traceback was:
Traceback (most recent call last):
File "/opt/letsencrypt/certbot/lib64/python3.13/site-packages/certbot/_internal/renewal.py", line 715, in handle_renewal_request
main.renew_cert(lineage_config, plugins, renewal_candidate)
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/letsencrypt/certbot/lib64/python3.13/site-packages/certbot/_internal/main.py", line 1548, in renew_cert
renewed_lineage = _get_and_save_cert(le_client, config, lineage=lineage)
File "/opt/letsencrypt/certbot/lib64/python3.13/site-packages/certbot/_internal/main.py", line 131, in _get_and_save_cert
renewal.renew_cert(config, sans, le_client, lineage)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/letsencrypt/certbot/lib64/python3.13/site-packages/certbot/_internal/renewal.py", line 565, in renew_cert
new_cert, new_chain, new_key, _ = le_client.obtain_certificate(sans, new_key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/opt/letsencrypt/certbot/lib64/python3.13/site-packages/certbot/_internal/client.py", line 434, in obtain_certificate
orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
File "/opt/letsencrypt/certbot/lib64/python3.13/site-packages/certbot/_internal/client.py", line 512, in _get_order_and_authorizations
authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort)
File "/opt/letsencrypt/certbot/lib64/python3.13/site-packages/certbot/_internal/auth_handler.py", line 104, in handle_authorizations
self._poll_authorizations(authzrs, max_retries, max_time_mins, best_effort)
~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/letsencrypt/certbot/lib64/python3.13/site-packages/certbot/_internal/auth_handler.py", line 208, in _poll_authorizations
raise errors.AuthorizationError('Some challenges have failed.')
certbot.errors.AuthorizationError: Some challenges have failed.
2026-06-30 15:51:12,209:DEBUG:certbot._internal.display.obj:Notifying user:Source: certbot/certbot