Lets Encrypt Certbot Commands: Full Guide

Certbot is the official command-line client for Let’s Encrypt, and its core commands are certbot certonly to obtain a certificate, certbot renew to renew certificates, and certbot install to install them. You run these commands on your server via SSH, and Certbot automatically handles the ACME protocol, domain validation, and certificate installation. This guide explains the essential Certbot commands, how to use them, and common troubleshooting steps.

What Is Certbot and Why Use It?

Certbot is a free, open-source tool developed by the Electronic Frontier Foundation (EFF) that automates obtaining and renewing SSL/TLS certificates from Let’s Encrypt, a free certificate authority. Before Certbot, getting a certificate involved manual steps: generating a key, creating a CSR, submitting it, waiting for validation, and then installing the certificate. Certbot simplifies this to a single command, and it also sets up automatic renewal, so your certificates never expire unexpectedly.

Let’s Encrypt certificates are valid for 90 days, which is short by design to encourage automation. Certbot’s main job is to make that 90-day cycle painless. It can also configure your web server (Apache or Nginx) to use the certificate, and it can even modify your server configuration to enable HTTPS redirects.

Installing Certbot

Before you can run Certbot commands, you need to install it. The installation method depends on your operating system and web server. The official Certbot website (certbot.eff.org) provides tailored instructions for your exact setup. Here are common examples:

• Ubuntu/Debian with Nginx: sudo apt update && sudo apt install certbot python3-certbot-nginx
• Ubuntu/Debian with Apache: sudo apt update && sudo apt install certbot python3-certbot-apache
• CentOS/RHEL with Nginx: sudo yum install certbot python3-certbot-nginx
• macOS (Homebrew): brew install certbot
• Windows: Use the Windows installer from the Certbot website, or use WSL (Windows Subsystem for Linux).

After installation, verify it works with certbot --version. If you see a version number, you’re ready.

Core Certbot Commands

Here are the most frequently used Certbot commands, with explanations of what they do:

• certbot certonly – Obtains a certificate but does not install it. This is useful if you want to manually configure your web server or if you’re using a non-standard setup.
• certbot run – Obtains a certificate and installs it (the default command). It will attempt to modify your web server configuration automatically.
• certbot install – Installs a certificate that you already have (e.g., one obtained with certonly) into your web server.
• certbot renew – Checks all existing certificates and renews any that are within 30 days of expiration. It does not restart your web server unless you use --deploy-hook.
• certbot delete – Deletes a certificate and its associated files.
• certbot revoke – Revokes a certificate (e.g., if your private key is compromised).
• certbot certificates – Lists all certificates managed by Certbot, showing their domains, expiration dates, and file paths.

How to Obtain a Certificate with Certbot

The most common way to get a certificate is with the certonly command, which gives you control over installation. Here’s a typical command:

sudo certbot certonly --nginx -d example.com -d www.example.com

This tells Certbot to use the Nginx plugin (--nginx) and to obtain certificates for example.com and www.example.com. If you use Apache, replace --nginx with --apache. If you don’t want to use a plugin, you can use the webroot method:

sudo certbot certonly --webroot -w /var/www/html -d example.com

Here, -w specifies the webroot directory where Certbot will place a temporary file for domain validation. This method works with any web server.

After running the command, Certbot will ask for an email address (for expiry notices) and to agree to the Terms of Service. Once completed, your certificate files will be in /etc/letsencrypt/live/example.com/. You’ll see fullchain.pem (the certificate) and privkey.pem (the private key).

Automatic Renewal and the Renew Command

Let’s Encrypt certificates expire every 90 days, but Certbot can automate renewal. The certbot renew command checks all certificates and renews any that are within 30 days of expiration. It’s safe to run this command as often as daily, as it does nothing if no certificate is due for renewal.

To set up automatic renewal, you can add a cron job or a systemd timer. For example, create a cron job:

0 3 * * * /usr/bin/certbot renew --quiet

This runs every day at 3 AM. The --quiet flag suppresses output unless there’s an error. If your web server needs to be reloaded after renewal, use the --deploy-hook option:

certbot renew --deploy-hook="systemctl reload nginx"

This runs the reload command only after a successful renewal. Many modern systems (like Ubuntu) come with a built-in systemd timer for Certbot, so you may not need to set up your own cron job.

Common Certbot Options and Flags

Certbot has many options to customize behavior. Here are some you’ll likely use:

• -d or --domains – Specify domain names (e.g., -d example.com). You can use multiple -d flags.
• --email – Provide your email address for renewal notices.
• --agree-tos – Automatically agree to the Let’s Encrypt Terms of Service (useful for automation).
• --non-interactive or -n – Run without prompts (useful for scripts).
• --force-renewal – Renew a certificate even if it’s not due (useful for testing).
• --dry-run – Test the renewal process without actually making changes (highly recommended).
• --webroot – Use the webroot method for validation.
• --nginx or --apache – Use the specific web server plugin.

Troubleshooting Common Issues

Even with Certbot, things can go wrong. Here are common problems and fixes:

• Validation errors (e.g., “Failed to connect to example.com”) – Make sure your domain resolves to your server’s IP and that port 80 (and 443) are open in your firewall. For webroot, ensure the directory is accessible.
• Rate limits – Let’s Encrypt has rate limits (e.g., 5 certificates per domain per week). If you hit them, wait, or use the staging environment (--staging) for testing.
• Renewal not working – Run certbot renew --dry-run to see errors. Common causes: the web server isn’t running, or the plugin is missing.
• Certificate files not found – Check /etc/letsencrypt/live/. Ensure the directory has correct permissions (usually root).
• Certbot command not found – Reinstall Certbot or check if it’s in your PATH (e.g., /usr/bin/certbot).

Costs and Safety Considerations

Let’s Encrypt certificates are completely free. There are no hidden costs, and Certbot is open-source. However, you should be aware of a few safety points:

• Backup your certificates – If you lose your private key, you cannot renew, and you’ll need to revoke and reissue. Back up the /etc/letsencrypt/ directory.
• Keep Certbot updated – The ACME protocol changes, and Certbot updates ensure compatibility. Use your package manager to update regularly.
• Use strong permissions – The private key (privkey.pem) should be readable only by root and the web server user. Certbot sets this by default.
• Test with staging – Use --staging to test commands without affecting your production certificates or hitting rate limits.

Alternatives to Certbot

Certbot is the most popular ACME client, but not the only one. Alternatives include:

• acme.sh – A shell script-based client that works on many systems, including routers and embedded devices.
• lego – A Go-based ACME client that can be used as a library or CLI.
• Nginx and Apache built-in support – Some web servers (e.g., Caddy) have native Let’s Encrypt integration, requiring no external tool.
• Cloud providers – Many hosting providers (e.g., Cloudflare, AWS) offer their own certificate management, often with free SSL.

Certbot remains the best choice for most users because of its maturity, documentation, and integration with major web servers.

Frequently Asked Questions

How do I renew a certificate manually?

Run sudo certbot renew. It will renew all certificates that are within 30 days of expiration. If you want to force renewal, add --force-renewal. After renewal, reload your web server (e.g., systemctl reload nginx) to pick up the new certificate.

Can I use Certbot with a non-standard web server?

Yes, you can use the webroot method, which works with any web server that can serve files from a directory. You don’t need a plugin; just specify --webroot -w /path/to/webroot.

What if I get a “Too Many Certificates” error?

You’ve hit Let’s Encrypt’s rate limit. Wait a week, or use the staging environment (--staging) for testing. Also, make sure you’re not requesting certificates for the same domain too often (e.g., for every subdomain separately).

How do I set up auto-renewal?

Most Linux distributions include a systemd timer or cron job for Certbot. Check with systemctl list-timers | grep certbot. If not, add a cron job: 0 3 * * * /usr/bin/certbot renew --quiet.

Can I get a wildcard certificate with Certbot?

Yes, use the DNS-01 challenge. For example: sudo certbot certonly --manual --preferred-challenges dns -d '*.example.com'. You’ll need to add a TXT record to your DNS. This requires manual intervention unless you use a DNS plugin (e.g., for Cloudflare).

What’s the difference between certonly and run?

certonly only obtains the certificate and saves it to disk; it doesn’t modify your web server configuration. run (the default) obtains and installs the certificate, automatically editing your server config. Use certonly if you prefer to configure your server manually.

Related

• Remap Mouse Scroll Wheel Click: Full Guide
• Logic Pro: How to Merge Multiple Takes
• Residential Proxy Abuse Detection Across Devices