Screenshot from the article

Introduction

SSL certificates are crucial for encrypting web traffic and ensuring secure communication between clients and servers. However, SSL certificates expire periodically, requiring renewal to maintain security. Automating SSL certificate rotation ensures uninterrupted service and compliance with security best practices.

This guide will cover:

  • SSL certificate management using Certbot on Ubuntu
  • Automating SSL certificate rotation with cron jobs
  • Advanced commands with examples
  • Best practices for SSL certificate management
  • Common issues and troubleshooting
  • FAQs

1. Installing Certbot on Ubuntu

Certbot is an open-source tool for automatically managing SSL/TLS certificates from Let’s Encrypt.

A. Installing Certbot

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

If using Apache, install Certbot with:

sudo apt install certbot python3-certbot-apache -y

B. Obtaining an SSL Certificate

sudo certbot --nginx -d example.com -d www.example.com

For Apache:

sudo certbot --apache -d example.com -d www.example.com

This command will:

  1. Request a certificate from Let’s Encrypt
  2. Verify domain ownership
  3. Configure Nginx/Apache to use the SSL certificate

2. Automating SSL Certificate Renewal

Let’s Encrypt certificates are valid for 90 days, so regular renewal is required.

A. Checking Renewal Status

To check existing certificates and expiry dates:

sudo certbot certificates

To manually renew certificates:

sudo certbot renew --dry-run

B. Automating Renewal with Cron Job

Let’s Encrypt suggests running the renewal process twice daily.

  1. Open the crontab editor:
sudo crontab -e

2. Add the following cron job to renew SSL certificates automatically:

0 2 * * * certbot renew --quiet --post-hook "systemctl restart nginx"

This command runs at 2 AM daily, renewing certificates if needed and restarting Nginx.

3. For Apache, replace nginx with apache2:

0 2 * * * certbot renew --quiet --post-hook "systemctl restart apache2"

3. Advanced Certbot Commands

A. Listing All Certificates

sudo certbot certificates

B. Deleting a Certificate

sudo certbot delete --cert-name example.com

C. Renewing a Specific Certificate

sudo certbot renew --cert-name example.com --force-renewal

D. Revoke a Certificate

sudo certbot revoke --cert-path /etc/letsencrypt/live/example.com/fullchain.pem

4. Best Practices for SSL Certificate Management

✅ Use wildcard certificates to secure multiple subdomains.

sudo certbot -d "*.example.com" --manual --preferred-challenges dns certonly

✅ Configure HTTP to HTTPS redirection in Nginx/Apache.

✅ Automate certificate renewal using cron jobs.

✅ Set up monitoring for expiry notifications.

5. Troubleshooting Common Issues

❓ Why is my certificate renewal failing?

✅ Ensure port 80 (HTTP) and port 443 (HTTPS) are open.

✅ Run a dry run: sudo certbot renew --dry-run.

✅ Check logs: sudo journalctl -u certbot --no-pager.

❓ How to fix Too Many Requests error?

✅ Check the rate limits on Let’s Encrypt: https://letsencrypt.org/docs/rate-limits/

✅ Use the staging server for testing:

sudo certbot renew --staging

❓ How to update Certbot to the latest version?

✅ Use Snap to install the latest Certbot version:

sudo snap install --classic certbot

6. Bash Script for SSL Certificate Rotation with Cron

If Certbot renewal is failing intermittently, a Bash script can add an extra layer of automation.

A. Creating the Script

  1. Create a new script file:
sudo nano /usr/local/bin/ssl_renew.sh

2. Add the following script:

#!/bin/bash
certbot renew --quiet
if [ $? -eq 0 ]; then
    systemctl restart nginx
    echo "SSL certificate renewed and Nginx restarted successfully on $(date)" >> /var/log/ssl_renew.log
else
    echo "SSL renewal failed on $(date)" >> /var/log/ssl_renew.log
fi

3. Make the script executable:

sudo chmod +x /usr/local/bin/ssl_renew.sh

B. Adding the Script to Cron

  1. Edit crontab:
sudo crontab -e

2. Add the following line:

0 3 * * * /usr/local/bin/ssl_renew.sh

This runs the script every day at 3 AM.

Conclusion

Automating SSL certificate rotation ensures secure and uninterrupted HTTPS access. Using Certbot with cron jobs or a custom Bash script simplifies this process, reducing manual intervention. Implement these best practices to enhance security and ensure smooth certificate management.

🚀 Stay Secure, Stay Automated!

📢 Have questions or feedback? Drop a comment below or connect with me on Twitter/X@spysood!

Originally published on Medium.