CheatCertbot Let's Encrypt client
Light · Postcard
102 × 152 mm · PDF
Dark · Postcard
102 × 152 mm · PDF
Ink saver · Postcard
102 × 152 mm · PDF
Light · A4 landscape
297 × 210 mm · PDF
Dark · A4 landscape
297 × 210 mm · PDF
Ink saver · A4 landscape
297 × 210 mm · PDF
Light · A3 landscape
420 × 297 mm · PDF
Dark · A3 landscape
420 × 297 mm · PDF
Ink saver · A3 landscape
420 × 297 mm · PDF
Start here
sudo certbot --nginx
Get and install a cert
sudo certbot certonly --webroot -w <dir> -d
<domain>
Get a cert only
sudo certbot certificates
List managed certs
sudo certbot renew --dry-run
Test renewal
sudo certbot renew
Renew due certs
sudo certbot delete --cert-name <name>
Remove a cert
systemctl list-timers
Is auto-renew set up?
sudo certbot certonly --standalone -d <domain>
Use a temporary server
Concepts
- Request certonly or run
- Validate HTTP-01 or DNS-01
- Store live/<name>/
- Renew timer + hooks
Obtain
certbot certonly -d <domain>
Get a cert, do not install it
certbot --nginx -d <domain>
Get a cert and edit nginx config
-d <a> -d <b>
Several names on one cert
--cert-name <name>
Name the cert (file paths, housekeeping)
--expand -d <old> -d <new>
Add a name to an existing cert
Give every name the cert should end up with, not only the new
one.
--stagingUse the test CA (no rate-limit risk)
--key-type rsa / ecdsa
Pick the key algorithm
ecdsa is the default since Certbot 2.0.
Authenticators
--webroot -w <dir>
Write challenge files into a live web root
Each -d uses the most recent -w, so put -w before its domains.
--standaloneRun a temporary server on port 80
Stop whatever listens on port 80 first, or use a hook.
--dns-cloudflare / --dns-route53
DNS-01 via a DNS provider plugin
--dns-cloudflare-credentials <file>
Credentials file for the DNS plugin
Keep it chmod 600.
Inspect and Renew
certbot certificates
List certs, names, expiry and paths
certbot renewRenew every cert that is due
certbot renew --dry-run
Test renewal against the staging CA
certbot renew --cert-name <name>
Renew one cert only
--force-renewalRenew even if not due
Repeated forced renewals hit rate limits.
--deploy-hook <cmd>
Run after a successful renewal only
--pre-hook <cmd>
Run before each renewal attempt
--post-hook <cmd>
Run after each renewal attempt
certbot install --cert-name <name>
Deploy an existing cert to the server
Manage Certs
certbot delete --cert-name <name>
Delete a cert and its renewal config
Remove it from the server config first, or the server will not
start.
certbot revoke --cert-name <name>
Revoke a cert at the CA
Files and Hooks
| Path | Holds |
|---|---|
live/<name>/fullchain.pem |
Cert plus chain: use this |
live/<name>/privkey.pem |
Private key |
live/<name>/cert.pem, chain.pem
|
Parts, rarely needed |
archive/<name>/ |
Numbered history |
renewal/<name>.conf |
Saved options for renew |
renewal-hooks/{pre,deploy,post}/ |
Executable scripts |
cli.ini |
Global defaults |
Recipes
sudo certbot certonly --webroot -w /var/www/example \ -d example.com -d www.example.com \ --deploy-hook 'systemctl reload nginx'# /root/cf.ini holds dns_cloudflare_api_token = ...chmod 600 /root/cf.inisudo certbot certonly --dns-cloudflare \ --dns-cloudflare-credentials /root/cf.ini \ -d example.com -d '*.example.com'sudo certbot renew \ --pre-hook 'systemctl stop nginx' \ --post-hook 'systemctl start nginx'# /etc/cron.d/certbot0 3,15 * * * root certbot renew -q \ --deploy-hook 'systemctl reload nginx'
