# Certbot + nginx + automatic renewal

**URL:** <https://community.letsencrypt.org/t/certbot-nginx-automatic-renewal/46869>\
**Category:** Server\
**Created:** [November 22, 2017, 6:51pm UTC](https://community.letsencrypt.org/t/certbot-nginx-automatic-renewal/46869 "2017-11-22T18:51:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ferenczy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ferenczy/32/17865_2.png) [@ferenczy](https://community.letsencrypt.org/u/ferenczy)\
**Post date:** [November 22, 2017, 6:51pm UTC](https://community.letsencrypt.org/t/certbot-nginx-automatic-renewal/46869/1 "2017-11-22T18:51:56Z")

</div>

Hi,

I have a question regarding the _automatic certificate renewal_ in a combination with _nginx_ server.

I have used `certbot certonly --webroot` command to get the certificate, something like:

`cerbot certonly --webroot -w /var/www/example.com -d example.com`

Nginx virtual host references certificates in `/etc/letsencrypt` directory directly:

`ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;`

Everything is working good.

As the last step, I wanted to configure the automatic renewal as a cron job. First, I have checked if the renewal works using the dry run: `certbot renew --dry-run`. But when I wanted to create a cron job, I noticed that it **already exists** in the file `/etc/cron.d/certbot` with the following content:

`0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew`

So it runs every 12 hours. That’s fine but **it’s not reloading nginx** so it won’t load the new certificate. I haven’t used the `nginx` plugin so certbot is not even aware I’m using nginx.

What should I do, please? Simply delete the existing cron job and create a new one with `--post-hook="service nginx reload`? Won’t certbot re-create the default cron job?

Thank you.

---

<div class="post-metadata">

**Author:** ![jmorahan](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jmorahan/32/1873_2.png) [@jmorahan](https://community.letsencrypt.org/u/jmorahan)\
**Post date:** [November 22, 2017, 7:47pm UTC](https://community.letsencrypt.org/t/certbot-nginx-automatic-renewal/46869/2 "2017-11-22T19:47:10Z")

</div>

If you’re using the latest version of certbot, there’s a directory `/etc/letsencrypt/renewal-hooks/deploy` where you could drop in a script to do the reloading.

---

<div class="post-metadata">

**Author:** ![Ten-Taken](https://avatars.discourse-cdn.com/v4/letter/t/ec9cab/32.png) [@Ten-Taken](https://community.letsencrypt.org/u/Ten-Taken)\
**Post date:** [November 23, 2017, 6:25am UTC](https://community.letsencrypt.org/t/certbot-nginx-automatic-renewal/46869/3 "2017-11-23T06:25:52Z")

</div>

Here is the [documentation](https://certbot.eff.org/docs/using.html#renewing-certificates) on hooks.

If I recall, /deploy hooks only fire if renewal is successful, while /post hooks will fire regardless.

For the hook scripts, stick with `#!/bin/sh` . I think I ran into trouble when using bash scripting. Also, I had to `chmod` executable permissions on the scripts, so it seems like Certbot doesn’t explicitly invoke a shell to execute them. Also note that none of the hooks fire on a `–dry-run` , so you’ll have to test with a `–force-renewal` flag to test your hooks.

I can’t comment on deleting the cron job, as I use systemd.timers to run services in my environment…but the hooks should solve your problem.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [December 23, 2017, 6:25am UTC](https://community.letsencrypt.org/t/certbot-nginx-automatic-renewal/46869/4 "2017-12-23T06:25:57Z")

</div>

Closed on December 23, 2017, 6:25am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.