Configure Certificate Renewal

When to use it

Once a server has Let's Encrypt certificates, so they renew by themselves and nginx serves each renewed certificate straight away. Let's Encrypt certificates last 90 days; without renewal, every site on the server goes insecure on the same day. Run Install Certbot first.

This playbook has no options.

What it does on the server

1. Turns on the Certbot package's own renewal timer: certbot.timer on Ubuntu and Debian, certbot-renew.timer from EPEL on the RHEL family (off by default there), or the snap's timer. Where none exists, it installs iap-certbot-renew.timer, which runs certbot renew at midnight and noon with up to an hour's random delay.
2. Installs /etc/letsencrypt/renewal-hooks/deploy/iap-reload-nginx.sh, which reloads nginx after each renewal, and only when nginx -t passes.
3. Reports when the timer runs next.
4. Warns about any certificate set to renew with Certbot's standalone server, which cannot work while nginx holds port 80.

It does not request certificates.

After the run

Run Check Certificate Renewal to prove renewal works end to end, and add an SSL certificate monitor in Monitoring so you are warned if a certificate ever gets close to expiring.

Common problems

"Certbot is not installed. Run Install Certbot first." — Run Install Certbot, then this playbook again.

"These certificates renew with Certbot's standalone server" — Those certificates were obtained another way and will fail to renew while nginx runs. Obtain them again with Configure Reverse Proxy, which uses the webroot method.