Understanding Certbot & Automated ACME SSL Certificates
Let's Encrypt is a non-profit, automated certificate authority (CA) providing free domain-validated (DV) SSL/TLS certificates. Certbot is the official client developed by the Electronic Frontier Foundation (EFF) that interfaces with Let's Encrypt using the Automated Certificate Management Environment (ACME) protocol. Running Certbot automates certificate requests, challenge validation, web server SSL block configuration, and automatic renewals.
HTTP-01 vs DNS-01 Challenge
Standard single domains and subdomains use the HTTP-01 challenge via port 80. Wildcard certificates (*.example.com) strictly require the DNS-01 challenge by provisioning automated TXT records on your DNS provider (e.g. Cloudflare).
Automatic Renewal Pipeline
Certbot installs a systemd timer (certbot.timer) that evaluates certificates twice daily. When certificates reach 30 days before expiration, they renew in the background without manual intervention.
Essential Certbot CLI Command Reference
| Operation | Certbot Command | Description |
|---|---|---|
| Nginx Auto-Install | sudo certbot --nginx -d domain.com -d www.domain.com | Issues certificate and configures Nginx server blocks automatically. |
| Apache Auto-Install | sudo certbot --apache -d domain.com -d www.domain.com | Issues certificate and modifies Apache VirtualHost directives. |
| Test Renewal | sudo certbot renew --dry-run | Simulates ACME renewal against staging CA without touching live keys. |
| List Certificates | sudo certbot certificates | Displays active domains, key paths, and remaining expiration days. |
| Revoke Certificate | sudo certbot revoke --cert-name domain.com | Revokes an issued certificate from the Let's Encrypt registry. |
Frequently Asked Questions
How long is a Let's Encrypt SSL certificate valid?
All Let's Encrypt SSL/TLS certificates are valid for 90 days. Certbot automatically installs a systemd timer or cron job that evaluates certificates twice daily and renews them when they have 30 days or fewer remaining.
What is the difference between the Nginx/Apache plugin and certonly?
The web server plugins (--nginx or --apache) obtain the certificate and edit your server block configuration automatically to inject SSL directives. The 'certonly' option issues the certificate files to disk without modifying any existing server configuration files.
How do I test automatic renewal without hitting rate limits?
Run 'sudo certbot renew --dry-run'. This executes the complete ACME validation cycle against the Let's Encrypt staging environment without replacing your production certificates or consuming official rate limits.