---
title: "Renew certificates automatically · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/hosting-and-network/certificate-renewal
updated: 2026-10-20
licence: "All rights reserved"
---

# Renew certificates automatically

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)
- Rule: Renew every certificate automatically, and get an alert when one has under 14 days left.
- How: Let an ACME client, such as certbot, renew on a timer and reload the server afterwards. Pick a client that follows ACME Renewal Information (RFC 9773), so the authority can ask for early renewal. Lifetimes are shrinking under CA/Browser Forum ballot SC-081, from 398 days to 200 in 2026, 100 in 2027 and 47 in 2029. Manual renewal will not keep up. Watch expiry from outside, together with the uptime check. Alert when any certificate has under 14 days left. ACME clients renew with about a third of the lifetime left, so an alert means renewal has failed for weeks. With 47-day certificates, renewal starts near 16 days, so lower the alert to about 7 days then.
- Check: `certbot renew --dry-run` succeeds. The outside monitor alerts when any certificate has under 14 days left.

Example:

```sh
systemctl list-timers | grep certbot
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/hosting-and-network/certificate-renewal`.

- Previous: [Send more in the first round trip](https://agentwranglers.se/playbook/website/hosting-and-network/tcp-initial-congestion-window)
- Next: [Choose who may issue your certificates](https://agentwranglers.se/playbook/website/hosting-and-network/caa-records)
- [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network)