Agent Wranglers

Hosting and network Required

Renew certificates automatically

Renew every certificate automatically, and get an alert well before one expires.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Let an ACME client, such as certbot, renew on a timer and reload the server afterwards. Lifetimes are shrinking, to 47 days by 2029 under CA/Browser Forum ballot SC-081, so manual renewal will not keep up. Watch expiry from outside, together with the uptime check.

Example

systemctl list-timers | grep certbot
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate

How to check

certbot renew --dry-run succeeds. The outside monitor alerts when a certificate has under 14 days left.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network/certificate-renewal.