Sametime: Let’s Encrypt automatic certificate renewal may fail

My friend and fellow HCL Ambassador Carsten Gericke alerted me about a problem with Sametime and Let’s Encrypt certificate

We identified an issue with automatic Let’s Encrypt certificate renewal in HCL Sametime 12.0.4 (tested with meetings-web:20260626-0004).

The Sametime nginx container runs with a read-only root filesystem:

read_only: true

When Let’s Encrypt is enabled, acme.sh tries to install a cron job for automatic certificate renewal. This can fail because /var/spool/cron/crontabs is not writable:

/var/spool/cron/: mkstemp: Read-only file system
Install cron job failed. You need to manually renew your certs.

The container continues to run normally, so the problem can remain unnoticed until the certificate expires.

Workaround

In docker-compose.yml, add /var/spool/cron/crontabs to the tmpfs section of the nginx service:

nginx:
…
read_only: true
tmpfs:
– /run:exec
– /var/run:exec
– /tmp
– /var/tmp/nginx
– /var/lib/nginx
– /var/spool/cron/crontabs

Then recreate the nginx container:

docker compose up -d –force-recreate nginx

Verify that the renewal cron job now exists:

docker compose exec nginx crontab -l

You should see an entry similar to:

17 9 * * * “/config/acme.sh”/acme.sh –cron –home “/config/acme.sh” > /dev/null

You can also check the certificate renewal status with:

docker compose exec nginx sh -c ‘
export LE_WORKING_DIR=/config/acme.sh
/config/acme.sh/acme.sh –list
‘

After adding the tmpfs mount, we verified that the cron job is automatically recreated when the nginx container is recreated and that acme.sh has a valid next renewal date.

This is currently a workaround; HCL Support should confirm the official fix.