automate Let's Encrypt SSL certificate renewal

check certificate expiration

View when your certificates expire:

certbot certificates # list all certificates and expiration dates

automate renewal

Let's Encrypt certificates expire every 90 days. To set up automatic renewal, edit your crontab:

crontab -e # edit crontab

Add this line to check for renewal twice daily:

0 0,12 * * * certbot renew --quiet --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx" # 0 0,12 * * * - Runs at 00:00 and 12:00 every day. # certbot renew --quiet - Attempts renewal quietly; only renews if necessary. # --pre-hook "systemctl stop nginx" - Stops Nginx before renewal (only if renewal happens). # --post-hook "systemctl start nginx" - Starts Nginx again after successful renewal.

verify automation

View your crontab to ensure the renewal is set up:

crontab -l # list all cron jobs