🔒
Certbot (Let's Encrypt) cheat sheet
Certbot automates getting certificates from Let's Encrypt. Your domain's DNS must point at the server (for HTTP challenges, ports 80 and 443 must be reachable). Most commands need sudo.
Click any command to copy it.
Get certificates
| Command | What it does |
|---|---|
sudo certbot --nginx -d example.com -d www.example.com | Obtain a certificate and configure nginx automatically. |
sudo certbot --apache -d example.com | Same for Apache. |
sudo certbot certonly --standalone -d example.com | Get a certificate using a temporary web server (port 80 must be free). |
sudo certbot certonly --webroot -w /var/www/html -d example.com | Get a certificate using your existing web root. |
sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" | Wildcard certificate using a DNS challenge. |
sudo certbot --nginx -d example.com -n --agree-tos -m you@example.com | Non-interactive issue for scripts. |
Renew
| Command | What it does |
|---|---|
sudo certbot renew --dry-run | Test renewal without changing anything. |
sudo certbot renew | Renew certificates that are close to expiry. |
sudo certbot renew --deploy-hook "systemctl reload nginx" | Reload the web server after a successful renewal. |
systemctl list-timers | grep certbot | Check that automatic renewal is scheduled. |
Inspect and manage
| Command | What it does |
|---|---|
sudo certbot certificates | List certificates, domains and expiry dates. |
sudo certbot delete --cert-name example.com | Destructive: Delete a certificate and its renewal configuration. |
sudo certbot revoke --cert-path /etc/letsencrypt/live/example.com/cert.pem | Destructive: Revoke a certificate. |
sudo certbot --expand -d example.com -d new.example.com | Add another name to an existing certificate. |
sudo certbot --nginx --redirect -d example.com | Also redirect HTTP to HTTPS. |
Where files live
| Command | What it does |
|---|---|
/etc/letsencrypt/live/example.com/fullchain.pem | Certificate plus chain; use as ssl_certificate. |
/etc/letsencrypt/live/example.com/privkey.pem | Private key; use as ssl_certificate_key. |
/var/log/letsencrypt/letsencrypt.log | Detailed log for troubleshooting failed issuance. |
Frequently asked questions
Why did my certificate not renew?
Common causes are a changed firewall or DNS record, port 80 not reachable, or the web server config no longer serving the challenge. Run certbot renew --dry-run and read /var/log/letsencrypt/letsencrypt.log.
How long are Let's Encrypt certificates valid?
They are short-lived: 90 days at the time of writing, with shorter lifetimes planned. Run certbot certificates to see the exact expiry, and rely on automatic renewal rather than a fixed number.