How To Auto Renew Let’s Encrypt SSL Certificates

In this tutorial, we will show you how to Auto Renew Let’s Encrypt SSL Certificates on your Linux server. For those of you who didn’t know, Let’s Encrypt is a free open certificate authority (CA) that provides free certificates for websites and other services. The service is backed by the Electronic Frontier Foundation, Mozilla, Cisco Systems, and Akamai. Unfortunately, LetsEncrypt.org certificates currently have a 3-month lifetime. This means you’ll need to renew your certificate quarterly for now.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges.

Let’s Encrypt SSL certificates will expire after 90 days of installation and you must renew them before it gets expire. If you have installed certificates using certbot then it must have already created a cronjob to auto-renew certificates. For custom installation, you can create a similar cronjob too. Let’s learn how Certbot’s auto-renew job works.

Prerequisites

• A server running one of the following operating systems: Ubuntu or any other Debian-based or RHEL-based distribution.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Auto Renew Let’s Encrypt SSL Certificates

Step 1. Installing Certbot.

The first step in setting up auto-renewal is to install Certbot on your Linux server. Certbot supports various Linux distributions, including Ubuntu, Debian, CentOS, Fedora, and more. The installation process varies slightly depending on your distribution but generally involves running a few commands to add the Certbot repository and install the necessary packages.

For example, on Ubuntu, you can install Certbot with the following commands:

sudo apt update
sudo apt install certbot

On CentOS, the process is slightly different:

sudo yum install epel-release
sudo yum install certbot

Step 2. Certbot Renew Command.

Certbot comes with a script to renew existing certificates. You can test the renewal script with a single dry run like below:

sudo certbot renew --dry-run

If the above test succeeds then create a cron job that will run this script for configured intervals.

Step 3. Certbot Auto-Renew Cron Job.

When you install certificates using certbot it automatically creates cron job to renew certificates. You can check this cron job depending on your operating system. For example, in Debian certbot auto-renew cronjob can be found at /etc/cron.d/certbot:

nano /etc/cron.d/certbot

# /etc/cron.d/certbot: crontab entries for the certbot package
#
# Upstream recommends attempting renewal twice a day
#
# Eventually, this will be an opportunity to validate certificates
# haven't been revoked, etc.  Renewal will only occur if expiration
# is within 30 days.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

0 */12 * * * root test -x /usr/bin/certbot  -a \! -d /run/systemd/system &&  perl -e 'sleep int(rand(43200))' &&  certbot -q renew

Step 4. Troubleshooting Renewal Issues.

While Certbot and Let’s Encrypt are designed to make the renewal process as seamless as possible, you may encounter issues from time to time. Here are some common troubleshooting tips:

• Permissions Issues: Ensure that Certbot has the necessary permissions to write to the required directories. You may need to run Certbot commands with sudo or adjust file permissions accordingly.
• Web Server Configuration: Double-check your web server configuration to ensure that it is correctly serving the required challenge files for domain validation. Certbot provides instructions for configuring various web servers during the initial setup process.
• Firewall Rules: If you’re running a firewall, ensure that it is not blocking the necessary ports for Let’s Encrypt’s domain validation process (typically ports 80 and 443).
• Rate Limiting: Let’s Encrypt implements rate limits to prevent abuse. If you encounter rate-limiting issues, you may need to adjust your renewal frequency or wait for the rate limit to reset.
• Logging: Enable verbose logging by adding the --verbose or --debug flag to Certbot commands to gather more detailed information about the renewal process and any errors that may occur.

Congratulations! You have successfully renewed Let’s Encrypt Certificates. Thanks for using this tutorial for auto-renewing Let’s Encrypt SSL Certificates on the Linux system. For additional help or useful information, we recommend you check the official Let’s Encrypt website.