How to Auto-Renew a Let's Encrypt Certificate

1. Check certificate expiry. Online: /en/ssl. CLI: sudo certbot certificates.
2. Dry-run renewal. sudo certbot renew --dry-run — tests the renewal without touching the live certificate.
3. Configure cron for auto-renewal. sudo crontab -e → 0 3 * * * certbot renew --quiet --post-hook "systemctl reload nginx"
4. SSL expiry monitoring. Enable Enterno.io SSL monitoring — email/Telegram alert 14 days before expiry if certbot fails for any reason.
5. Post-renewal verification. After a minute, check curl -sI https://example.com — new Not-After expected. Or Ctrl+Shift+R in the browser.

Open tool →

Let's Encrypt certificates are crucial for ensuring secure connections on your website. However, they come with an expiration period of just 90 days. This short lifespan is designed to encourage automation in certificate management. If you're managing a website, it's vital to understand how this expiration affects your service and what steps to take to avoid downtime.

When a certificate approaches its expiration date, browsers will start displaying warnings to users, which can lead to trust issues and loss of traffic. Therefore, knowing when your certificate expires is essential. You can check the expiration date of your certificate using the following command:

openssl x509 -in /etc/letsencrypt/live/yourdomain.com/fullchain.pem -noout -dates

This command will output the start and end dates of your certificate, allowing you to plan for renewal. It's advisable to monitor your certificates regularly to ensure they are renewed before expiration.

Renewing Let's Encrypt certificates can sometimes lead to issues that prevent successful renewal. Understanding these common problems can save you time and help you maintain your website's security. Here are a few issues you might encounter:

• Domain Validation Failures: Let's Encrypt needs to validate your domain before issuing or renewing a certificate. If your domain's DNS settings are incorrect or if the server isn't reachable, the renewal process will fail.
• Rate Limits: Let's Encrypt enforces rate limits on certificate issuance. If you attempt to renew too frequently (more than five times per week for the same domain), you will hit this limit. Check your current status using the command:

certbot certificates

• Expired Certificates: If your certificate has expired, you may need to address any configuration issues before you can renew. Ensure that your web server is correctly configured to serve the challenge files required for validation.

By being aware of these issues, you can take preemptive measures to ensure a smooth renewal process.

While many users rely on cron jobs for automating the renewal of Let's Encrypt certificates, systemd timers offer a more modern and flexible approach. This method allows for more precise scheduling and better integration with systemd services.

To set up a systemd timer for renewing your Let's Encrypt certificates, follow these steps:

1. Create a new service file:

[Unit]
Description=Renew Let's Encrypt Certificates

[Service]
Type=oneshot
ExecStart=/usr/bin/certbot renew --quiet --post-hook "systemctl reload nginx"

2. Save this file as /etc/systemd/system/certbot-renew.service.
3. Now create a timer file:

[Unit]
Description=Run Certbot Renewal Daily

[Timer]
OnCalendar=*-*-* 3:00:00
Persistent=true

[Install]
WantedBy=timers.target

4. Save this as /etc/systemd/system/certbot-renew.timer.
5. Finally, enable and start the timer:

sudo systemctl enable certbot-renew.timer
sudo systemctl start certbot-renew.timer

This setup will automatically attempt to renew your certificates every day at 3 AM. If the renewal is successful, it will reload your Nginx server to apply the changes.