Let’s Encrypt certificates are valid for 90 days, and their validity period will be further reduced in the coming years: the tlsserver profile, which has been available since May 2026, already issues 45-day certificates, and according to Let’s Encrypt’s announcement, the default profile will be 64 days from February 2027 and 45 days from February 2028. Renewal must therefore be automated in all cases; manual commands are only required for verification and troubleshooting.

There is nothing to do on the hosting account

On cPanel hosting and web hosting plans, free certificates are automatically renewed by the system; this is covered in the article on Let’s Encrypt free certificates. The following applies to self-managed VPS or dedicated servers where the certificate was requested via Certbot; the process is explained in the article on requesting certificates with Certbot.

Certificate status

sudo certbot certificates

The command displays the domains, Expiry Date and file locations for each certificate.

Is automatic renewal enabled?

During installation, Certbot sets up a timer that checks the certificates twice a day:

systemctl list-timers | grep -i certbot

For Certbot installed from a package, this is certbot.timer; for a Snap installation, it is snap.certbot.renew.timer. If the timer is running, there is no need for a separate cron job. If you cannot find it, you can set one up using a cron job:

17 3,15 * * * /usr/bin/certbot renew --quiet

Manual renewal

sudo certbot renew

The command only renews certificates that are close to expiry (typically 30 days before expiry for a 90-day certificate). You can request the immediate renewal of a specific certificate using the --cert-name pelda.hu --force-renewal switches, but please only use this where justified, as Let’s Encrypt limits the number of times a certificate can be requested for the same domain.

Reloading the web server

The web server will only use the renewed certificate after it has been reloaded. For certificates requested using the Apache or Nginx extensions, Certbot handles this automatically; in other cases (for example, in --standalone or --webroot) mode), specify a deploy hook:

sudo certbot renew --deploy-hook "systemctl reload nginx"

Certbot makes a note of this, so it will run again at the next automatic renewal.

If the renewal fails

Try the renewal process first without actually submitting a request:

sudo certbot renew --dry-run

The most common causes:

• The domain no longer points to this server, or the www subdomain has no DNS record.
• The firewall is blocking port 80; this must be open for HTTP-01 validation.
• A redirect or the .htaccess file is preventing access to the /.well-known/acme-challenge/ folder.
• A CAA record prevents Let’s Encrypt from issuing a certificate.

Details of the error can be found in the /var/log/letsencrypt/letsencrypt.log file.

Expiry notification

Let’s Encrypt has not been sending expiry notification emails since 4 June 2025, so if the renewal fails silently, you will only find out when the certificate expires. It is worth setting up an external monitoring service or your own monitoring script; the article on checking SSL certificate expiry provides instructions on how to do this.