How to Automate SSL Renewal with ACME and Certbot

The 10-minute Certbot setup

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
# Test the renewal path before trusting it:
sudo certbot renew --dry-run
# Then let the built-in timer handle it (twice-daily check, renews <30d left):
systemctl status certbot.timer

Two details people skip: always run --dry-run (staging environment, no rate limits burned), and verify the timer actually exists — half of “certbot didn't renew” incidents are a missing cron/systemd timer on a rebuilt server.

HTTP-01 vs DNS-01: pick once, correctly

• HTTP-01: serves a token on port 80. Simplest for single servers; fails behind strict firewalls and can't do wildcards.
• DNS-01: sets a TXT record. Required for *.yourdomain.com wildcards; needs your DNS provider's API token stored for automation — rotate it and scope it to TXT edits only.

The deploy hook everyone forgets

Renewing the file is half the job — the server must load it. Add a hook (e.g. --deploy-hook "systemctl reload nginx") or you'll serve a shiny new certificate from disk while visitors get the expired one from memory. Verify after every renewal with an external check, not localhost.

Automation needs a watchdog

ACME tells you nothing when it breaks — no email, no page, just an expiry date approaching at full speed. Independent expiry monitoring watches what visitors actually receive, catching failed renewals, missing hooks, and half-deployed fleets. Set it up free in 30 seconds and stop thinking about renewal forever.