Let’s Encrypt certificates are valid for only 90 days, so production sites should always enable automatic renewal to avoid HTTPS downtime.

If you already issued the certificate with Certbot, there are usually two things left:

1. Configure a scheduled renewal task
2. Verify the renewal workflow actually works

First, Check Whether Certbot Already Created a Scheduler

Depending on your distro, Certbot may already install a scheduler (for example, a systemd timer or /etc/cron.d/certbot).

You can check with:

1

systemctl list-timers | grep certbot

If a valid timer already exists, you usually do not need an extra crontab entry.

Add a Crontab Job Manually (Recommended Example)

If you prefer managing renewal explicitly, edit root crontab:

1

sudo crontab -e

Add this line (runs daily at 03:00):

1

0 3 * * * certbot renew --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx" >> /tmp/certbot-renew.log 2>&1

What it means:

• 0 3 * * *: run at 03:00 every day
• certbot renew: renew certificates that are close to expiration
• --pre-hook: stop Nginx before renewal (common for standalone mode)
• --post-hook: start Nginx after renewal
• >> /tmp/certbot-renew.log 2>&1: append logs for troubleshooting

Run a Dry Test Before Relying on Cron

After adding the task, validate the full flow manually:

1

sudo certbot renew --dry-run

If dry-run succeeds, you can safely rely on the scheduled job.

Common Notes

1. If you use the webroot or nginx plugin, you often do not need to stop Nginx. In many setups, reloading Nginx after renewal is enough:

1

certbot renew --deploy-hook "systemctl reload nginx"

2. certbot renew only performs actual renewal near expiration, so running it daily is normal.

3. For long-term maintenance, consider writing logs to a persistent path such as /var/log/letsencrypt/.

Summary

Reliable certificate auto-renewal is not just about writing a command. The key is confirming the workflow can run end to end.

A stable setup is usually just these three steps:

1. Check whether system-level scheduling already exists
2. Add cron if needed and keep logs
3. Validate once with --dry-run