How to Renew Let’s Encrypt SSL Certificates Automatically with Certbot

Securing your website with an SSL certificate is essential to protect user data, enable HTTPS, and improve your SEO ranking. However, manually renewing SSL certificates can be time-consuming and prone to human error. Automating the SSL renewal process ensures continuous security, prevents downtime due to expired certificates, and simplifies certificate management.

In this guide, we’ll use Let’s Encrypt — a free, automated, and open Certificate Authority (CA) — and the Certbot tool to set up automated SSL certificate renewal on your server.

Before proceeding, make sure you have:

• A running web server (Apache) installed on your machine.
• A valid domain name pointing to your server’s IP address with a proper DNS A record.

Always start by updating your package manager to ensure you have the latest repositories.

sudo apt update

Certbot is a free and open-source tool that automates the process of installing, renewing, and managing SSL certificates.

For Nginx or Apache servers, install Certbot with:

sudo apt install certbot python3-certbot-nginx

To fully automate SSL certificate renewal, let’s create a custom Bash script named ssl.sh.

vi ssl.sh

Paste the following script into the file, then save and exit.

note: You may want to change domain and email section with your own.

#!/bin/bash

# Define domain and email variables
DOMAIN="devopsdeniz.com"
EMAIL="[email protected]"

# Define the path to the Let's Encrypt script
LE_SCRIPT="/usr/bin/certbot"

# Define the path to the SSL certificate
CERTIFICATE_PATH="/etc/letsencrypt/live/$DOMAIN/fullchain.pem"

# Define the path to the certificate renewal log file
LOG_FILE="/var/log/certbot-renewal.log"

# Check if the certificate needs renewal
if ! $LE_SCRIPT renew --dry-run > $LOG_FILE 2>&1; then

 # Certificate needs renewal, execute renewal
 echo "$(date +"%Y-%m-%d %H:%M:%S") - Certificate for $DOMAIN needs renewal" >> $LOG_FILE
 
 # Execute certificate renewal
 $LE_SCRIPT renew --noninteractive --agree-tos --email $EMAIL >> $LOG_FILE 2>&1
 
 # Check if renewal was successful
 if [ $? -eq 0 ]; then
 echo "$(date +"%Y-%m-%d %H:%M:%S") - Certificate for $DOMAIN successfully renewed" >> $LOG_FILE

 # Restart web server to apply changes (Apache)
 systemctl restart httpd
 else
 echo "$(date +"%Y-%m-%d %H:%M:%S") - Certificate renewal for $DOMAIN failed" >> $LOG_FILE
 fi
else

 # Certificate doesn't need renewal
 echo "$(date +"%Y-%m-%d %H:%M:%S") - Certificate for $DOMAIN is up to date, no renewal needed" >> $LOG_FILE
fi

To ensure your SSL certificate is automatically renewed without manual intervention, schedule the script in cron.

Open the crontab editor:

crontab -e

Add the following line to run the renewal check daily at midnight:

0 0 * * * /bin/bash /path/to/ssl.sh

chmod +x ssl.sh

bash ssl.sh

You can follow logs if certbot is working properly.

cat /var/log/certbot-renewal.log

Benefits of Automating SSL Renewal

By using Certbot with Let’s Encrypt, you gain:

• Security: Continuous HTTPS encryption for your website.
• Convenience: Fully automated certificate renewals with no manual intervention.
• SEO Boost: Google prioritizes websites with valid SSL certificates.
• Reliability: Prevents downtime caused by expired SSL certificates.

With this setup, your SSL certificates will be automatically renewed, your website will remain secure, and you’ll avoid service interruptions caused by expired certificates.

Troubleshooting Common Issues with Nginx Load Balancer and SSL

Even after setting up your Nginx load balancer and SSL certificates, you may run into some common issues. Here’s how to fix them:

1. Certbot Renewal Errors

• Error: Failed authorization procedure
  • Cause: Nginx is not serving the /.well-known/acme-challenge/ directory correctly.
  • Fix: Make sure your server block includes:

location ~ /.well-known/acme-challenge/ {
allow all;
}

• Error: Too many certificates issued for the same domain
  • Cause: You’ve requested certificates too frequently.
  • Fix: Wait a few hours before retrying or test using the –staging flag.

2. Backend Server Health Checks

If Nginx keeps sending traffic to a server that is down:

• Use proxy_next_upstream directive to automatically failover to another server.
• Example:

proxy_next_upstream error timeout invalid_header http_502 http_503 http_504;

3. High Latency or Load Issues

• Enable least_conn or ip_hash algorithm if round-robin isn’t distributing traffic efficiently.
• Consider adding caching with proxy_cache for better performance.