My domain is milan.com
The instance is: amazon linux
So every 3 months i need to renew my ssl certificate and i am doing it manually.
So in AWS I have hosted zones -> milan.com
The steps i am doing is ->
When i am in the instance logged i enter this command: sudo certbot --manual --preferred-challenges dns certonly. Then I manually enter all the domains that i need to be renewed like alpha.milan.com, milan.com, inter.milan.com and etc. (*.milan.com ). Then the output provide me TXT Records for every domain which i need to change txt record in the AWS. Then after i change all txt record in the AWS, i restart the httpd service on the instance.
!!! milan.com is example !!!
Note that when/if you've got the DNS plugin working, it should be enough to run sudo certbot renew to renew your certificate(s). This is usually done with a cronjob or systemd timer, which may or may not be already installed, depending on how you've installed Certbot to begin with.
I think you are overcomplicating the process.
A cron job that runs immediately after renewal attempts would reload/restart the httpd service way too often.
Certs last 90 days.
They only need to be renewed after 60 days [default].
The renewal process runs and first checks to see if any certs need to be renewed.
Most of the times, there is nothing to renew.
Either:
use a deploy-hook to reload/restart the httpd service [which is only triggered when a cert is actually renewed]
schedule the reload/restart without any regard to the cert state [like once a week (every week) during off hours]
The cert should renew 30 days ahead of expiry - that should cover four reloads/restarts.
Hello,
Thanks for the answer So I entered the command sudo certbot certonly --dns-route53 --dns-route53-propagation-seconds 30 -d domain.com -d up.domain.com and all went great and successfully So what i understand from your message is that , every 60 days the certbot will automatically update the certificates without nothing additional to do after the command that I entered before ? No need anything else to do ? Only adding the deploy-hook or schedule reload
Yes.
That command will only renew the cert ["certonly"].
So, at some point you must update whatever is using the old cert to use the updated cert.
Using a deploy-hook is ideal - but there plenty of ways to get [essentially] the same result.
So I entered the command sudo certbot certonly --dns-route53 --dns-route53-propagation-seconds 30 -d 