Table of Contents
- Why Let's Encrypt Certificates Expire Every 90 Days
- Installing Certbot on Ubuntu / Debian / CentOS
- Obtaining Your First Certificate
- Auto-Renewal with systemd Timer
- Auto-Renewal with Cron Job
- Verifying That Auto-Renewal Works
- Troubleshooting Common Renewal Errors
- Let's Encrypt vs. Paid SSL: A Comparison
- Using Let's Encrypt with DirectAdmin
- Frequently Asked Questions
- Summary
Let's Encrypt is a free, automated Certificate Authority that has made HTTPS accessible to everyone. But one thing that catches many server administrators off guard: Let's Encrypt certificates expire every 90 days. Without automatic renewal configured correctly, your site will display "Not Secure" warnings the moment the certificate expires. This guide covers everything you need to know to set up reliable auto-renewal.
Why Let's Encrypt Certificates Expire Every 90 Days
The 90-day lifetime is intentional, not a limitation. Let's Encrypt designed it this way for good security reasons:
- Limits damage from compromised keys: If your private key is stolen, the certificate becomes useless within 90 days at most.
- Forces automation: Short-lived certificates push administrators to automate renewal, reducing human error and forgotten renewals.
- Reduces reliance on revocation: Certificate Revocation Lists (CRL) and OCSP have known caching problems. Short lifetimes make these less critical.
Certbot renews a certificate when less than 30 days remain, meaning renewal happens roughly every 60 days in practice — giving you a comfortable buffer.
💡 Good to know: Certbot installed via Snap on Ubuntu automatically creates a systemd timer. Installing via apt/yum may require setting up a cron job manually depending on your distribution.
Installing Certbot on Ubuntu / Debian / CentOS
The recommended approach in 2026 is the Snap package, which always provides the latest Certbot version and automatically sets up a systemd timer.
Ubuntu 22.04 / 24.04 (Recommended)
sudo apt update
sudo apt install snapd -y
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbotDebian 12
sudo apt update && sudo apt install certbot python3-certbot-nginx -y
# For Apache:
sudo apt install certbot python3-certbot-apache -yCentOS / AlmaLinux / Rocky Linux
sudo dnf install epel-release -y
sudo dnf install certbot python3-certbot-nginx -yVerify the installation:
certbot --version
# Expected output: certbot 2.x.xObtaining Your First Certificate
Before configuring auto-renewal, you need an initial certificate. Certbot can configure your web server automatically:
For Nginx
sudo certbot --nginx -d example.com -d www.example.comFor Apache
sudo certbot --apache -d example.com -d www.example.comStandalone Mode (No Web Server)
sudo certbot certonly --standalone -d example.comCertbot will prompt for an email address for expiry notifications — use a real address you monitor regularly.
⚠️ Note: Ports 80 and 443 must be open in your firewall during certificate requests and renewals. Let's Encrypt uses HTTP-01 or DNS-01 challenges to verify domain ownership.
Auto-Renewal with systemd Timer
Certbot installed via Snap automatically creates a systemd timer called snap.certbot.renew.timer. Check its status with:
sudo systemctl status snap.certbot.renew.timer
# For apt-installed Certbot:
sudo systemctl status certbot.timerAn active (waiting) status means Certbot will run daily renewal checks automatically.
View when the timer is scheduled to run next:
sudo systemctl list-timers | grep certbotEnable the timer if it isn't running:
sudo systemctl enable --now certbot.timer
sudo systemctl enable --now snap.certbot.renew.timerAuto-Renewal with Cron Job
For systems without systemd, or if you want explicit control over timing:
sudo crontab -eAdd this line to run renewal checks twice daily at 3:30 AM and 3:30 PM (as recommended by Let's Encrypt):
0 3,15 * * * /usr/bin/certbot renew --quiet --deploy-hook "systemctl reload nginx"For Apache, replace nginx with apache2:
0 3,15 * * * /usr/bin/certbot renew --quiet --deploy-hook "systemctl reload apache2"--quiet suppresses normal output and only shows errors. --deploy-hook reloads the web server only when a renewal actually occurs.
Verifying That Auto-Renewal Works
Always test before your certificate expires in production.
Dry Run Test
sudo certbot renew --dry-runA successful output ends with Congratulations, all renewals succeeded.
Check Current Certificate Expiry
sudo certbot certificatesLists all certificates, their expiry dates, and days remaining.
Check via OpenSSL
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | \
openssl x509 -noout -datesView Certbot Logs
sudo tail -50 /var/log/letsencrypt/letsencrypt.logTroubleshooting Common Renewal Errors
Error: Could Not Bind to IPv4/IPv6 (Port 80 in Use)
This happens when using --standalone while a web server occupies Port 80:
sudo systemctl stop nginx
sudo certbot renew
sudo systemctl start nginxBetter: use the --nginx or --apache plugin instead of standalone to avoid stopping the server.
Error: Too Many Requests / Rate Limit Exceeded
Let's Encrypt limits certificates to 50 per domain per week. Use the staging environment for testing:
sudo certbot --nginx --staging -d example.comError: Domain Validation Failed
Check the following:
- Firewall has Port 80 open:
sudo ufw allow 80 - DNS points to the correct server IP
- Web server is running and can serve files from
/.well-known/acme-challenge/
sudo ufw status
nslookup example.com
curl http://example.com/.well-known/acme-challenge/testCertificate Renewed but Site Still Shows Old Certificate
The web server hasn't reloaded. Run:
sudo systemctl reload nginx
# or
sudo systemctl reload apache2Or add a deploy hook to Certbot's renewal config:
sudo nano /etc/letsencrypt/renewal/example.com.conf
# Add:
deploy_hook = systemctl reload nginxLet's Encrypt vs. Paid SSL: A Comparison
| Feature | Let's Encrypt | Paid SSL (DV/OV/EV) |
|---|---|---|
| Cost | Free | From ~$30/year |
| Certificate Lifetime | 90 days (auto-renewed) | 1–3 years |
| Validation Types | DV only | DV / OV / EV |
| Wildcard SSL | Yes (DNS-01 challenge required) | Yes |
| Multi-domain (SAN) | Yes (up to 100 domains) | Yes |
| Organization Verification | No | Yes (OV/EV shows company name) |
| Warranty | None | $10,000–$1,750,000 USD |
| Support | Community forums | 24/7 technical support |
| Best For | Personal sites, dev, startups | Business, e-commerce, banking |
💡 Recommendation: Let's Encrypt is excellent for personal sites, blogs, and non-payment web apps. For e-commerce or business sites that handle payment card data, consider OV or EV SSL with organizational verification and warranty coverage.
Using Let's Encrypt with DirectAdmin
If you use hosting with DirectAdmin, you don't need Certbot at all — DirectAdmin has built-in Let's Encrypt integration:
- Log in to your DirectAdmin control panel
- Go to SSL Certificates in Account Manager
- Select Free & automatic certificate from Let's Encrypt
- Click Save
- DirectAdmin issues the certificate and configures auto-renewal automatically
AsiaGB's hosting plans all include Let's Encrypt through DirectAdmin at no extra cost, with no command-line setup required.
Frequently Asked Questions
How often does Let's Encrypt SSL expire?
Let's Encrypt SSL certificates expire every 90 days. Certbot renews automatically when less than 30 days remain, so in practice renewal happens roughly every 60 days.
How does Certbot auto renewal work?
Certbot checks certificates daily via systemd timer or cron job. When a certificate has less than 30 days remaining, it downloads a new certificate and reloads the web server automatically with zero downtime.
What happens if Certbot renewal fails?
The existing certificate remains valid until actual expiry. One or two failed renewals won't immediately break your site. But if renewal keeps failing until the certificate expires, browsers will block visitors with an SSL error. Set up email alerts to catch failures early.
Can I use Let's Encrypt with DirectAdmin?
Yes. DirectAdmin has built-in Let's Encrypt support. Enable it in the SSL Certificates section of your control panel — no Certbot installation needed.
What is certbot renew --dry-run?
The --dry-run flag tests the entire renewal process without downloading an actual new certificate. Always run a dry-run test after configuring Certbot to confirm everything is working correctly.
Does Let's Encrypt support Wildcard SSL?
Yes, but only via DNS-01 challenge. Run: certbot certonly --manual --preferred-challenges dns -d "*.example.com" and add the required TXT DNS record to verify domain ownership.
Summary
Configuring Let's Encrypt auto-renewal with Certbot is straightforward once you know the steps:
- Install Certbot via Snap (Ubuntu) or apt/dnf for other distros
- Obtain your first certificate with
certbot --nginxorcertbot --apache - Verify the systemd timer is active:
systemctl status certbot.timer - If no timer exists, add a cron job to run
certbot renew --quiettwice daily - Always test with
certbot renew --dry-runfirst - Monitor renewal logs and set up email alerts for failures
AsiaGB hosting customers using DirectAdmin don't need to do any of this — Let's Encrypt auto-renewal is managed at the control panel level. For sites requiring higher trust, warranty coverage, or organizational validation, check out AsiaGB's SSL certificate options.
Need a Higher-Trust SSL Certificate?
AsiaGB offers DV, OV, EV, and Wildcard SSL certificates with warranty and 24/7 support for business-critical websites.
View SSL Certificates →