0

I'm trying to set up SSL Certificate auto renewal on my boss's Amazon LightSail server. It was previously set up by a past contractor who isn't being a lot of help. I am very unfamiliar with Let's Encrypt so I searched for an article. I found this guide on how to renew it. I followed the steps up to step 4 but the script that it says to add to my crontab file is for apache. When I checked the conf file in the renewal folder, it shows that the installer used was nginx and that the authenticator is standalone. In this case, how would I be able to modify the script to set an auto renewal for the SSL certificate.

Here's the script: 45 2 * * 6 cd /etc/letsencrypt/ && ./certbot-auto renew && /etc/init.d/apache2 restart

Improve this question

1 Answer 1

Reset to default
2

The Let's Encrypt folks have created guides for most combinations of operating systems and web servers.

Here is their guide for Ubuntu 16 & nginx: https://certbot.eff.org/lets-encrypt/ubuntuxenial-nginx.html

I would use a cronjob that looks something like this:

0 * * * * /full/path/to/certbot-auto renew && service nginx restart

Test out the commands before you create the cronjob to ensure that they work. I use root's crontab. If you are using a different user you might need to add sudo to the commands.

Change the frequency that the cronjob runs at to your liking. Let's Encrypt certificates last 3 months, so keep that in mind.

I force renew my Let's Encrypt certificates every 2 months before they even get close to expiring, but that is probably overkill.

Improve this answer
9
  • Also, I keep trying to understand plugins from the certbot documentation. Technically, I'm running a server using Amazon Lightsail but the plugin used to install the certificate is nginx which, to my google searches, is a web server and much more. Is it just using a component of nginx to install the certificate and that's it? What are the advantages of using nginx over apache for example or does it not really matter?
    – P_Locked
    Apr 8, 2019 at 2:32
  • See stackoverflow.com/questions/53337530/…
    – bmccord
    Apr 8, 2019 at 17:50
  • It sounds like the previous contractor installed nginx as the web server. If it is working I would leave well enough alone and stick with the current config. If you want to verify that nginx is running there are a couple of commands you can use. ps aux | grep nginx This will show you if there are nginx processes running. netstat -nlp | grep nginx This will show you the ports that nginx is listening on. I would expect it to be listening on 80 ad 443.
    – bmccord
    Apr 8, 2019 at 21:55
  • Actually, the contractor uses a Python Daphne server instead of nginx. This is what really confuses me about him using ngninx as an installer for certbot. His directions to renew the server are actually running this command. 'sudo certbot --authenticator standalone --installer nginx -d example.com --pre-hook "service nginx stop" --post-hook "service nginx start"' and then copying over the new certificates over to the daphne server/django folder.
    – P_Locked
    Apr 10, 2019 at 17:58
  • Have you been able to renew the certs by following the instructions he provided? If you are able to do it manually you could write a shell script that performs the same steps and execute that script with a cron job.
    – bmccord
    Apr 10, 2019 at 18:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .