Auto-Renew TLS Certificates & Fix Failures

Updated 15 November 2026 · Standard formula, shown below

This guide explains how to set up automatic renewal for TLS/SSL certificates using the ACME protocol (typically with Certbot) and how to diagnose and fix common renewal failures. You’ll learn the essential commands, scheduling, and troubleshooting steps to keep your certificates valid without manual intervention.

What You’ll Need

A server running Linux (Ubuntu/Debian, CentOS/RHEL, or similar) with root or sudo access.
A domain name pointing to your server’s public IP address.
Web server software (Apache or Nginx) installed and configured to serve your domain.
Port 80 (HTTP) and 443 (HTTPS) open in your firewall.
Basic familiarity with the command line.

Step-by-Step

Install Certbot and the appropriate plugin. For Apache: sudo apt install certbot python3-certbot-apache (Debian/Ubuntu) or sudo yum install certbot python3-certbot-apache (RHEL/CentOS). For Nginx, replace apache with nginx.
Obtain an initial certificate. Run sudo certbot --apache (or --nginx) and follow the prompts. Select your domain and choose to redirect HTTP to HTTPS. This creates a certificate that is valid for 90 days.
Test automatic renewal. Certbot installs a systemd timer (or cron job) that runs twice daily. To verify it works, run sudo certbot renew --dry-run. This simulates the renewal process without actually replacing the certificate. You should see a success message for each domain.
Check the renewal timer. On systemd systems, run sudo systemctl list-timers | grep certbot to confirm the timer is active. On older systems, check /etc/cron.d/certbot.
Configure auto-deployment. If your web server doesn’t automatically pick up the new certificate (most do), add a --deploy-hook to reload the server. For example, add --deploy-hook "systemctl reload nginx" to the renewal command in the timer file.
Monitor renewal logs. Check /var/log/letsencrypt/letsencrypt.log for renewal attempts. Successful renewals are logged, and failures include error details.
Set up email alerts. Certbot sends expiration notices to the email you provided. Ensure this address is monitored. You can also use external monitoring services to alert you before expiration.

Common Mistakes

Not testing the renewal. Skipping the dry-run means you only discover issues when the certificate actually expires.
Blocking port 80. The ACME HTTP-01 challenge requires port 80 to be reachable. If your firewall blocks it, renewal fails.
Using a wildcard certificate. Wildcard certificates require DNS-01 challenges, which need API access to your DNS provider. This is more complex and prone to misconfiguration.
Editing the renewal config incorrectly. The renewal configuration files in /etc/letsencrypt/renewal/ are auto-generated. Manually editing them can break renewal.
Forgetting to reload the web server. Some servers cache the certificate. Without a reload, the old certificate continues to be served.

Tips

Use the --force-renewal flag only for testing, not for regular renewals, as it can hit rate limits.
Set up a cron job to run certbot renew weekly as a backup to the timer.
Keep Certbot updated: sudo apt update && sudo apt upgrade certbot.
For large fleets, consider using a central management tool like Ansible to manage certificates across servers.
If you use a CDN, ensure the origin server’s certificate is also renewed.

Troubleshooting

If automatic renewal fails, follow these steps:

Run the dry-run again. sudo certbot renew --dry-run will show the exact error. Common errors include:
– Invalid response from http://domain/.well-known/acme-challenge/... – This means the HTTP challenge file wasn’t served. Check that the web server is running and that the directory is accessible.
– Timeout during connect – Port 80 is blocked. Check your firewall and security groups.
– DNS problem: NXDOMAIN – Your domain doesn’t resolve to this server. Update DNS records.
Check the log file. Look at /var/log/letsencrypt/letsencrypt.log for the full error trace.
Verify web server configuration. Ensure that the .well-known/acme-challenge directory is served by your web server. For Nginx, you may need to add a location block. For Apache, the plugin usually handles it.
Check the renewal configuration. Run sudo certbot certificates to see the certificate details and renewal settings. If the domain is missing, you may need to re-run the initial setup.
Try a manual renewal. sudo certbot renew --force-renewal (use with caution due to rate limits). If this succeeds, the issue is likely with the timer or cron job.
Check systemd timer status. sudo systemctl status certbot.timer to see if it’s active and when it last ran. If it’s not running, enable it: sudo systemctl enable --now certbot.timer.
Test DNS resolution. Use dig domain to confirm the domain resolves to your server’s IP.
If using a CDN or proxy, ensure the challenge reaches the origin. Temporarily bypass the CDN to test.

Frequently Asked Questions

How often does Certbot renew certificates?

Certbot checks twice daily and renews certificates that are within 30 days of expiration. This is safe because Let’s Encrypt allows renewals after 60 days.

Can I renew certificates for multiple domains at once?

Yes, you can specify multiple domains with -d domain1 -d domain2 when obtaining the initial certificate. Renewal will then cover all domains.

What happens if my certificate expires?

Browsers will show a security warning, and your site will be inaccessible over HTTPS. You must renew manually to restore service.

Do I need to stop my web server to renew?

No, the HTTP-01 challenge works alongside your running server. The plugin temporarily modifies the configuration to serve the challenge file.

Can I use this method for certificates from other CAs?

Yes, the ACME protocol is used by many CAs. Certbot supports Let’s Encrypt, ZeroSSL, and others. You may need to specify the CA with --server.

What if my server is behind a NAT or firewall?

You must forward ports 80 and 443 to your server. If you can’t, consider using DNS-01 challenges, which require API access to your DNS provider.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.