Let's Encrypt certificates are valid for only 90 days by design, to limit the impact of a compromised or forgotten certificate. Certbot handles renewal automatically in most installations, but it's worth verifying this is actually working before you're caught by an expired certificate.
Checking Certificate Expiry Dates
sudo certbot certificatesThis lists every managed certificate along with its expiry date.
Verifying the Automatic Renewal Timer Is Active
On Ubuntu/Debian, Certbot installs a systemd timer:
sudo systemctl status certbot.timerYou should see it listed as active. If instead your installation uses a cron job:
cat /etc/cron.d/certbotTesting Renewal Without Actually Renewing
sudo certbot renew --dry-runThis simulates the full renewal process and reports any errors, without replacing a still-valid certificate.
Manually Forcing a Renewal (If Needed)
sudo certbot renew --force-renewalRenewing a Specific Certificate Only
sudo certbot renew --cert-name example.comWhat Happens After a Successful Renewal
Certbot automatically reloads Nginx/Apache to pick up the new certificate files — no manual restart is normally required.
Setting Up Renewal Notifications
By default, Let's Encrypt emails the address provided during setup if renewal fails repeatedly. Confirm your registered email is current:
sudo certbot update_account --email [email protected]Manually Scheduling Renewal via Cron (If the Timer Isn't Present)
sudo crontab -e0 3 * * * /usr/bin/certbot renew --quiet --deploy-hook "systemctl reload nginx"Common Errors
"Challenge failed" during renewal — usually means DNS no longer points to this server, or port 80 is blocked; verify both before retrying.
Renewal succeeds but the site still shows the old/expired certificate — the web server wasn't reloaded; run sudo systemctl reload nginx (or apache2) manually.
Certificate expired without warning — the renewal timer/cron job was disabled or failing silently; check sudo journalctl -u certbot.timer for history.
Best Practices
- Run
certbot renew --dry-runright after initial setup to confirm automation works - Check
certbot certificatesperiodically, don't assume renewal is silently succeeding forever - Keep your registered email address current for failure notifications
FAQ
Do I need to do anything manually if auto-renewal is working?
No — once confirmed via a dry run, renewal happens automatically twice daily (Certbot only actually renews when a certificate is within 30 days of expiry).
Related Articles
- How to Install Let's Encrypt SSL with Certbot (Nginx & Apache)
- How to Install a Wildcard SSL Certificate with Certbot DNS Challenge
- How to Schedule Tasks with Cron on a Linux VPS
