Quick answer: Let's Encrypt certificates live 90 days and certbot renews them automatically via a systemd timer — normally you do nothing. To check the automation, run sudo certbot renew --dry-run; to force a renewal, sudo certbot renew.
Overview
Certbot installs a timer that runs twice a day and renews any certificate with less than 30 days left. Renewal repeats the original validation, so whatever made issuance work (DNS pointing here, port 80 open) must still be true months later — that is where renewals usually break.
Before you start
- SSH access with sudo.
- Know your current certificates and expiry dates:
sudo certbot certificatesStep-by-step guide
- Confirm the automation is active:
systemctl list-timers | grep certbot- Simulate a renewal without touching real certificates:
sudo certbot renew --dry-run- If the dry run passes, you are done — renewals will happen unattended.
- If a certificate is already close to expiry and you want it renewed now:
sudo certbot renew
sudo systemctl reload nginx # or apache2 — load the fresh certificateCommon issues
- Dry run fails with a challenge error: port 80 got firewalled since issuance, or DNS moved — restore reachability.
- Renewed on disk but browser shows the old expiry: the web server was not reloaded; add a
--deploy-hook "systemctl reload nginx". - Certificate for a domain you dropped: certbot keeps trying and failing; remove it with
sudo certbot delete.
When to contact support
If renewals fail with network-level errors from a Cloud2Y server (timeouts to the ACME API while the rest of the network is fine), open a ticket with the certbot log from /var/log/letsencrypt/.
Frequently asked questions
Do Let's Encrypt certificates renew automatically?
Yes — certbot installs a systemd timer that checks twice daily and renews certificates with under 30 days left. Verify it with sudo certbot renew --dry-run once after setup.
Why did my certificate expire despite certbot?
Renewal repeats the original validation, so it breaks when port 80 gets firewalled, DNS moves away, or the web server config changed. The dry-run command reveals the exact error.
The certificate renewed but the browser shows the old one — why?
The web server is still serving the old file from memory. Reload nginx or Apache after renewal, or add a deploy hook so certbot reloads it automatically every time.
Related articles
- How to install a free SSL certificate
- How to fix the SSL mixed content issue
- How to redirect HTTP to HTTPS
Ready to get started? Order a VPS at Cloud2Y →
