How to Renew a Let's Encrypt SSL Certificate (Automated + Manual)

Let’s Encrypt certificates are valid for 90 days. Renewal must be automatic — a 90-day cycle is short enough that manual renewal fails eventually.

Prerequisites

Existing Let’s Encrypt cert (or a first-time issuance need)
Access to the web server / CDN / edge terminating TLS
Port 80 or DNS-01 challenge capability

Renewal Path 1 — certbot (Most Common)

If you initially issued the cert with certbot on your web server, certbot installed a cron job or systemd timer that runs certbot renew twice daily. It only actually renews when the cert is <30 days from expiry.

Check it’s running:

sudo systemctl list-timers | grep certbot
sudo certbot renew --dry-run

--dry-run simulates a renewal without actually issuing. If it succeeds, real renewals work too.

Force a renewal manually:

sudo certbot renew --force-renewal
sudo systemctl reload nginx  # or apache2

Renewal Path 2 — acme.sh (Cross-Platform)

If you used acme.sh:

acme.sh --renew -d yourdomain.com --force

acme.sh installs its own cron job — verify with:

crontab -l | grep acme

Renewal Path 3 — CDN-Managed (Cloudflare, Fastly, AWS ACM)

If you’re behind a CDN or use a managed cert service:

Cloudflare Universal SSL — automatic, no action needed. Cloudflare renews 15 days before expiry.
AWS Certificate Manager (ACM) — automatic for domains validated via DNS. Certs bound to ELB/CloudFront/API Gateway renew silently.
Fastly TLS — automatic on managed cert plans; check the Fastly UI for cert status.
Vercel / Netlify / Fly.io — automatic — Let’s Encrypt renewed weekly, effectively no expiry to manage.

Verification

After renewal (or automatically ongoing), verify with the SSL certificate checker:

Certificate is fresh (issued recently)
Not-after date is 60-90 days out
Full chain served (including intermediate)

Common Miss

No renewal automation set up — cert expires in 90 days, site goes down
HTTP-01 challenge blocked by firewall or Cloudflare — switch to DNS-01
Chain not served correctly after renewal — fix web server config to include fullchain.pem
ACME account rate limits — Let’s Encrypt allows 5 duplicate cert requests per week

Preparing for 47-Day Certs (2029)

The CA/Browser Forum SC-081v3 timeline drops max cert lifetime to 200 days (2026), 100 days (2027), and 47 days (2029). Let’s Encrypt already ships 90-day certs. If your renewal automation works today, you’re already 2029-ready. If you renew manually, start automating now — the 47-day era makes manual renewal impossible at scale.

Check your cert lifecycle and expiry with the SSL certificate checker.

Read what an SSL certificate is, check the SSL/TLS glossary entry, and see the CAA glossary entry for cert issuance restrictions.