SSL cert renewal via ACME (Let’s Encrypt, ZeroSSL) is the modern standard. Use certbot or acme.sh for automated renewal. Per the SSL Store, industry is moving to 47-day max validity by 2029 - automation is no longer optional. The team that uses ACME with cron or systemd timers has certs that renew without manual work.
Table of contents
- Why renewal matters
- The 47-day shift
- ACME clients
- Certbot basics
- Auto-renewal with cron
- DNS-01 challenge
- Renewal hooks
- When not to use Let’s Encrypt
- FAQ
Why renewal matters
Expired certs cause:
- Browsers show ‘Not Secure’ warning.
- APIs reject connections.
- Users lose trust.
The team that has automated renewal has zero cert-related outages. The team that relies on calendar reminders has at least one outage per year.
The 47-day shift
Apple announced in 2024 that SSL/TLS cert max validity will drop to 47 days by 2029. The current 90-day (Let’s Encrypt) and 1-year (paid) certs will need to be reissued 8x per year per domain.
The team that uses ACME automation is ready for the shift. The team that manually renews will fail.
ACME clients
- certbot (EFF): the original ACME client. Mature, well-documented.
- acme.sh: lightweight shell-script ACME client. No dependencies.
- Caddy: web server with built-in ACME.
- Traefik: reverse proxy with built-in ACME.
- nginx-proxy-le: companion for nginx.
- Cloud provider: most cloud LBs have ACME integration (AWS Certificate Manager, GCP Managed Certs).
Certbot basics
Install certbot, get a cert:
sudo apt install certbot
sudo certbot certonly --nginx -d example.com -d www.example.comOr for webroot mode:
sudo certbot certonly --webroot -w /var/www/html -d example.comOr for standalone (requires port 80 free):
sudo certbot certonly --standalone -d example.comCert lands in /etc/letsencrypt/live/example.com/. The team that uses certbot has industry-standard tooling.
Auto-renewal with cron
Certbot installs a cron job or systemd timer. Verify:
sudo systemctl status certbot.timer
# or
sudo certbot renew --dry-runThe team that has the timer running has automatic renewal every 60 days (for 90-day certs).
DNS-01 challenge
For wildcard certs (*.example.com) or when HTTP-01 isn’t possible:
certbot certonly --dns-cloudflare \
--dns-cloudflare-credentials ~/.secrets/cloudflare.ini \
-d example.com -d "*.example.com"DNS-01 requires API access to the DNS provider. The team that uses DNS-01 has wildcard certs and works with internal-only services.
Renewal hooks
Run commands on cert renewal:
certbot renew --deploy-hook "systemctl reload nginx"The team that uses deploy hooks has services automatically reload after renewal.
When not to use Let’s Encrypt
For EV (extended validation) certs, wildcard with multi-org validation, or internal PKI, use:
- DigiCert, Sectigo, GlobalSign: paid CA with EV support.
- Internal CA: Vault PKI, Step-CA, Microsoft AD CS.
The team that needs EV for compliance uses paid CAs. The team that needs internal-only uses internal CAs.
FAQ
How much does Let’s Encrypt cost?
Free. Operated by ISRG, a non-profit. Wildcard certs are also free (with DNS-01 challenge).
How often should certs be renewed?
Auto-renew when 1/3 of the validity remains. For 90-day certs, that’s every 60 days. The team that has certbot’s timer runs this automatically.
What if cert renewal fails?
Certbot notifies via email if renewal fails. The team that monitors this email catches renewal issues before certs expire.
Can I get a wildcard cert from Let’s Encrypt?
Yes - via DNS-01 challenge. Requires API access to your DNS provider.
What’s the difference between DV, OV, and EV certs?
DV (Domain Validation): Let’s Encrypt. OV (Organization Validation): paid CA, verifies org. EV (Extended Validation): paid CA, highest trust. The team that needs EV for compliance uses paid CAs.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: