--- a/host/renewSsl.sh	Mon Dec 08 11:26:31 2025 -0700
+++ b/host/renewSsl.sh	Tue Dec 09 16:37:56 2025 -0800
@@ -1,13 +1,21 @@
 #!/bin/bash
 set -e
 
-# for now - fschmidt
-echo 'totally fucked up'
-exit 1
-
-cd "$1" || exit 1
+if [ -n "$1" ]; then
+  cd "$1" || echo "no first argument passed, staying in cwd"
+fi
 
 ROOTPWD=$(pwd)
+# this awkward method is used for portability
+ROOTPWDOWNER=$(ls -ld $ROOTPWD | awk '{printf "%s", $3}')
+
+# change to owner of host/ if running as root
+# prevents nginx being unable to read files owned by root
+if [ "$(id -u)" -eq 0 ]; then
+  echo "switching to $ROOTPWDOWNER in order to preserve permissions"
+  exec sudo -u $ROOTPWDOWNER "$0" "$@"
+fi
+
 KEYFILE="$ROOTPWD/local/tiny_account.key"
 for SITEROOT in "$ROOTPWD"/sites/*; do
   {
@@ -34,7 +42,16 @@
       --account-key "$KEYFILE" \
       --csr "$CSRFILE" \
       --acme-dir "$CHALLENGEDIR" \
-      > "$TMPOUT"
+      >"$TMPOUT"
+
+    wc -c <$TMPOUT
+
+    # If TMPOUT is empty, something failed.
+    if [ ! -s "$TMPOUT" ]; then
+      echo "Error: $TMPOUT is empty - please see previous output for details.\nContinuing to next domain..."
+      rm -f "$TMPOUT"
+      continue
+    fi
 
     # check if exists
     if [ -f "$FULLCHAIN" ]; then