Automatically Renew Let's Encrypt Certificates on Ubuntu (Certbot + Nginx)

Fri, 03 Apr 2026 00:00:00 +0000

Let’s Encrypt certificates are valid for only 90 days, so production sites should always enable automatic renewal to avoid HTTPS downtime.

If you already issued the certificate with Certbot, there are usually two things left:

First, Check Whether Certbot Already Created a Scheduler

Depending on your distro, Certbot may already install a scheduler (for example, a systemd timer or /etc/cron.d/certbot).

You can check with:

`1`	`systemctl list-timers \| grep certbot`

If a valid timer already exists, you usually do not need an extra crontab entry.

If you prefer managing renewal explicitly, edit root crontab:

`1`	`sudo crontab -e`

Add this line (runs daily at 03:00):

`1`	`0 3 * * * certbot renew --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx" >> /tmp/certbot-renew.log 2>&1`

What it means:

After adding the task, validate the full flow manually:

`1`	`sudo certbot renew --dry-run`

If dry-run succeeds, you can safely rely on the scheduled job.

If you use the webroot or nginx plugin, you often do not need to stop Nginx. In many setups, reloading Nginx after renewal is enough:

`1`	`certbot renew --deploy-hook "systemctl reload nginx"`

certbot renew only performs actual renewal near expiration, so running it daily is normal.
For long-term maintenance, consider writing logs to a persistent path such as /var/log/letsencrypt/.

Reliable certificate auto-renewal is not just about writing a command. The key is confirming the workflow can run end to end.

A stable setup is usually just these three steps: