Skip to main content
Operations

Configure Automatic SSL Certificate Renewal

Configure automatic SSL certificate renewal and deployment with CertOne, acme.sh, and Certbot.

CertOne4 min read

Automatic SSL certificate renewal helps prevent service interruptions caused by expired certificates. This guide covers renewal configuration with CertOne, acme.sh, and Certbot.

1. Why Automatic Renewal Matters​

1. Why Automate Renewal?​

Prevent expiration:

  • Expired certificates can prevent visitors from accessing your website.
  • Emergency certificate replacement takes time.
  • Outages affect users and business operations.

Save time:

  • Avoid manually renewing certificates.
  • Reduce repetitive administrative work.
  • Reduce the risk of human error.

Maintain security:

  • Keep certificates valid.
  • Reduce security risks.
  • Maintain service continuity.

2. Benefits of Automatic Renewal​

  • ✅ Renew certificates before they expire.
  • ✅ Minimize manual intervention.
  • ✅ Reduce human error.
  • ✅ Maintain service continuity.

2. Automatic Renewal with CertOne​

1. Enable Automatic Renewal​

  1. Sign in to CertOne
  2. Open Certificates
  3. Find the certificate you want to configure.
  4. Click "Configure".

2. Configure automatic renewal​

Renewal settings:

  • Enable automatic renewal before expiration.
  • Set the renewal lead time, such as 30 days where supported.
  • Choose what happens after renewal.

Deployment settings:

  • Enable automatic deployment after renewal.
  • Select the deployment nodes.
  • Configure the deployment parameters.

3. Notification Settings​

Renewal notifications:

  • Enable notifications after renewal.
  • Set the notification email address.
  • Select the notification channels.

3. Automatic Renewal with acme.sh​

1. How Automatic Renewal Works​

A standard acme.sh installation creates a cron job that checks certificates and renews them when they become eligible.

View the cron job:

crontab -l | grep acme.sh

2. Trigger Renewal Manually​

# Renew a specific certificate
~/.acme.sh/acme.sh --renew -d example.com

# Check all certificates for renewal
~/.acme.sh/acme.sh --renew-all

# Force renewal
~/.acme.sh/acme.sh --renew -d example.com --force

3. Configure Automatic Deployment​

# Configure deployment when installing the certificate
~/.acme.sh/acme.sh --install-cert -d example.com \
  --key-file /etc/nginx/ssl/key.pem \
  --fullchain-file /etc/nginx/ssl/fullchain.pem \
  --reloadcmd "systemctl reload nginx"

4. Automatic Renewal with Certbot​

1. How Automatic Renewal Works​

Many Certbot installation methods provide a systemd timer or cron job to renew eligible certificates. Check the scheduler installed on your system.

View the timer:

sudo systemctl list-timers | grep certbot

2. Test Automatic Renewal​

# Test renewal without replacing the production certificate
sudo certbot renew --dry-run

3. Trigger Renewal Manually​

# Check all certificates for renewal
sudo certbot renew

# Force renewal of a specific certificate
sudo certbot renew --cert-name example.com --force-renewal

4. Configure Automatic Deployment​

Edit /etc/letsencrypt/renewal/example.com.conf:

[renewalparams]
renew_hook = systemctl reload nginx

5. A Custom Renewal Script​

1. Create the Renewal Script​

Create renew-cert.sh:

#!/bin/bash

DOMAIN="example.com"
CERT_DIR="/etc/nginx/ssl"

# Check whether the certificate needs renewal
DAYS_LEFT=$(echo | openssl s_client -connect $DOMAIN:443 -servername $DOMAIN 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2 | xargs -I {} date -d {} +%s | awk '{print int(($1-systime())/86400)}')

if [ $DAYS_LEFT -lt 30 ]; then
    # Renew the certificate
    ~/.acme.sh/acme.sh --renew -d $DOMAIN --force
    
    # Deploy the certificate
    cp ~/.acme.sh/$DOMAIN/fullchain.cer $CERT_DIR/fullchain.pem
    cp ~/.acme.sh/$DOMAIN/$DOMAIN.key $CERT_DIR/private.key
    
    # Restart the service
    systemctl reload nginx
    
    # Send a notification
    echo "The certificate has been renewed automatically." | mail -s "SSL Certificate Renewal" admin@example.com
fi

2. Schedule the Script​

# Add this entry to crontab
crontab -e

# Check once per day
0 2 * * * /path/to/renew-cert.sh

6. Synchronize Certificates Across Servers​

1. Use CertOne Automatic Deployment​

  1. Create multiple deployment nodes in CertOne.
  2. Configure automatic deployment.
  3. Deploy the renewed certificate to all selected nodes automatically.

2. Synchronize with a Script​

Create a synchronization script, sync-cert.sh:

#!/bin/bash

CERT_DIR="/etc/nginx/ssl"
SERVERS=("server1.example.com" "server2.example.com")

for SERVER in "${SERVERS[@]}"; do
    # Copy the certificate to the remote server
    scp $CERT_DIR/*.pem $CERT_DIR/*.key user@$SERVER:/etc/nginx/ssl/
    
    # Restart Nginx on the remote server
    ssh user@$SERVER "systemctl reload nginx"
done

7. Monitoring and Alerts​

1. Renewal Success Notifications​

Configure a notification after successful renewal:

# Add this to the renewal script
echo "Certificate renewal succeeded." | mail -s "SSL Certificate Renewed" admin@example.com

2. Renewal Failure Alerts​

Configure an alert when renewal fails:

# Check whether renewal succeeded
if [ $? -ne 0 ]; then
    echo "Certificate renewal failed. Manual action is required." | mail -s "SSL Certificate Renewal Failed" admin@example.com
fi

3. Use CertOne Monitoring​

  1. Create a certificate monitor in CertOne.
  2. Configure expiration reminders.
  3. Monitor certificate status

Best practices​

1. Renewal Configuration​

  • ✅ Configure a suitable renewal lead time, such as 30 days where supported.
  • ✅ Configure automatic deployment.
  • ✅ Set up notifications and alerts.
  • ✅ Check renewal status regularly.

2. Verification​

  • ✅ Test automatic renewal regularly.
  • ✅ Validate the renewed certificate.
  • ✅ Verify successful deployment.
  • ✅ Confirm that the service is healthy.

3. Backup and Recovery​

  • ✅ Back up certificates and private keys securely.
  • ✅ Document renewal settings.
  • ✅ Prepare a recovery procedure.

9. Common questions​

1. Renewal Failure​

Possible causes:

  • DNS validation failed.
  • HTTP validation failed.
  • Network problems

Resolution:

  • Check the validation configuration.
  • Check network connectivity
  • Trigger renewal manually.

2. Deployment Failure​

Possible causes:

  • File permissions
  • The service failed to restart.
  • The configuration is incorrect.

Resolution:

  • Check file permissions
  • Check the service status.
  • Validate the configuration file.

3. Missing Notifications​

Issue: Renewal succeeded, but no notification arrived.

Resolution:

  • Check the email configuration.
  • Check the spam folder.
  • Verify notification settings.

Conclusion​

Automatic renewal helps prevent expired certificates and maintain service continuity. It reduces manual work and the risk of operational errors.

Key points:

  • ✅ Use CertOne automatic renewal.
  • ✅ Configure automatic renewal with acme.sh or Certbot.
  • ✅ Set up automatic deployment.
  • ✅ Configure monitoring and alerts.

CertOne provides automatic certificate renewal and deployment to simplify ongoing certificate management.