Agent Wranglers

APS-102Required

Renew certificates automatically

Renew every certificate automatically, and get an alert when one has under 14 days left.

By Agent Wranglers. Updated .

How to do it

Let an ACME client, such as certbot, renew on a timer and reload the server afterwards. Pick a client that follows ACME Renewal Information (RFC 9773), so the authority can ask for early renewal. Under CA/Browser Forum ballot SC-081, certificates issued since 15 March 2026 last at most 200 days. The cap goes from 200 to 100 days on 15 March 2027, and from 100 to 47 days on 15 March 2029. Manual renewal will not keep up. Keep one list of every certificate you depend on, with its owner and expiry, including internal service, client and code-signing certificates. Watch expiry from outside, together with the uptime check. Alert when any certificate has under 14 days left. ACME clients renew with about a third of the lifetime left, so an alert means renewal has failed for weeks. With 47-day certificates, renewal starts near 16 days, so lower the alert to about 7 days then.

Examples

Shell example

systemctl list-timers | grep certbot
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate

How to check

certbot renew --dry-run succeeds. The outside monitor alerts when any certificate has under 14 days left. A script compares the certificate list with the names the monitor watches and fails on any name missing from either.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/cryptography-and-keys/certificate-renewal">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.