Automatically Renewed SSL: Setup on a Linux Server with certbot

This guide explains how to use your automatically renewed SSL (ACME) subscription on your Linux server with certbot. You set it up once; after that the certificate is renewed automatically before it expires.

Before you start

• Your subscription must be started: on your service page in the client area, press Configure now and enter your domains.
• The domain must point to this server's IP address and port 80 must be open to the internet. If you use a firewall, allow ports 80 and 443.
• Run the commands as root or with sudo. The examples use Nginx; if you use Apache, write apache instead of nginx.

1. Install certbot

Debian and Ubuntu:

sudo apt update
sudo apt install certbot python3-certbot-nginx

AlmaLinux, Rocky Linux and RHEL: certbot is installed from the EPEL repository. On these systems the automatic renewal task is off by default; the last line turns it on.

sudo dnf install epel-release
sudo dnf install certbot python3-certbot-nginx
sudo systemctl enable --now certbot-renew.timer

On version 10, if the second command fails with nothing provides … cryptography, EPEL is serving packages for a newer release than yours. Run it with your system's version (e.g. 10.2):

sudo dnf install certbot python3-certbot-nginx --setopt=epel.metalink='https://mirrors.fedoraproject.org/metalink?repo=epel-10.2&arch=x86_64'

2. Get the setup commands from the client area

In the client area, open your subscription under Services > SSL Certificates and press Setup commands. Under the Linux option in the window there are two commands; you can copy each with its Copy button. The commands are specific to your subscription: do not share the keys in them.

3. Connect certbot to your subscription

Run the first command in the window once on your server. It looks like this:

certbot register \
--server https://one.digicert.com/mpki/api/v1/acme/v2/directory \
--eab-kid YOUR_ACCOUNT_KEY \
--eab-hmac-key YOUR_HMAC_KEY

certbot asks for an e-mail address and asks you to accept the terms of service. You only do this once.

4. Get your certificate

The second command in the window gets the certificate for the domains on your subscription and installs it in Nginx:

sudo certbot --nginx --server https://one.digicert.com/mpki/api/v1/acme/v2/directory \
  -d example.com \
  -d www.example.com

Do not remove the --server part; without it certbot tries to get a certificate from another provider. www.example.com is added to your subscription automatically and free of charge when you add example.com, and it is in the command too. Only names on the subscription can go on the certificate.

5. Check automatic renewal

On Debian and Ubuntu, certbot turns on the renewal task itself when it is installed. On AlmaLinux, Rocky Linux and RHEL it is turned on by the systemctl enable --now certbot-renew.timer line in step 1. You can see your certificates and their expiry dates with:

sudo certbot certificates

To see that the renewal task is active:

systemctl list-timers | grep certbot

If this shows nothing, certbot may be renewing through cron: ls /etc/cron.d/ | grep certbot

Wildcard certificates

Wildcard domains such as *.example.com cannot be validated with a file; they are validated with a DNS record. For automatic renewal to work, use your DNS provider's certbot plugin (e.g. python3-certbot-dns-cloudflare for Cloudflare). DNS validation done by hand with --manual is not renewed automatically.

Common problems

• Connection refused, Timeout or Unauthorized: the domain does not point to this server or port 80 is closed. Check the DNS record and your firewall.
• Invalid KID: the account key in the step 3 command is missing or wrong. Copy the command again from the window in the client area.
• Server requires external account binding: step 3 was not done. Run the first command in the window first.
• Unable to process new order request (domain_not_allowed): one of the names in the command is not on the subscription. Add it to your subscription in the client area first.
• The certificate came from Let's Encrypt: --server was missing from the command. Run step 4 again with --server.

If you get stuck at any step, you can open a support ticket from the client area.