# Certonly --force-renewal

**URL:** <https://community.letsencrypt.org/t/certonly-force-renewal/247654>\
**Category:** Help\
**Created:** [May 30, 2026, 10:37pm UTC](https://community.letsencrypt.org/t/certonly-force-renewal/247654 "2026-05-30T22:37:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![56629](https://avatars.discourse-cdn.com/v4/letter/5/4491bb/32.png) [@56629](https://community.letsencrypt.org/u/56629)\
**Post date:** [May 30, 2026, 10:37pm UTC](https://community.letsencrypt.org/t/certonly-force-renewal/247654/1 "2026-05-30T22:37:19Z")

</div>

When should you use `certonly --force-renewal`?

How does it work? My manual-auth-hook and manual-cleanup-hook scripts aren't getting called but I thought they would.

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [May 30, 2026, 10:58pm UTC](https://community.letsencrypt.org/t/certonly-force-renewal/247654/2 "2026-05-30T22:58:56Z")

</div>

> [@56629](#):
>
> When should you use `certonly --force-renewal`?

Almost never. It used to be more helpful before the `reconfigure` command was created.

What if you run `certbot renew --dry-run`

You should be using --dry-run instead of production anyway when testing your hooks.

Let's Encrypt caches authorizations and I believe Certbot only calls those hooks when a new auth is needed. See the LE docs about profiles for the cache duration: [Profiles - Let's Encrypt](https://letsencrypt.org/docs/profiles/)

The --dry-run will deactivate prior valid auths so new ones are then needed

---

<div class="post-metadata">

**Author:** ![56629](https://avatars.discourse-cdn.com/v4/letter/5/4491bb/32.png) [@56629](https://community.letsencrypt.org/u/56629)\
**Post date:** [May 31, 2026, 7:03pm UTC](https://community.letsencrypt.org/t/certonly-force-renewal/247654/3 "2026-05-31T19:03:44Z")

</div>

When should I use --test-cert alone or with --dry-run?

---

<div class="post-metadata">

**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\
**Post date:** [May 31, 2026, 7:29pm UTC](https://community.letsencrypt.org/t/certonly-force-renewal/247654/4 "2026-05-31T19:29:48Z")

</div>

--dry-run will deactivate prior auths. --test-cert will not. If used, you use just one of them.

They both use the Let's Encrypt Staging system

--test-cert will save the cert acquired from LE. --dry-run will not

When --test-cert is used interactively I believe Certbot will ask before clobbering a production cert. But, don't hold me to that I didn't verify current behavior. I don't recall you mentioning which version of Certbot you use so couldn't have commented on that anyway.

If you are not current, you should upgrade

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 30, 2026, 7:30pm UTC](https://community.letsencrypt.org/t/certonly-force-renewal/247654/5 "2026-06-30T19:30:18Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.