# How to correctly add auto-renewal (Debian 9 (Stretch)) **URL:** \ **Category:** Help\ **Created:** [November 7, 2019, 10:40am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775 "2019-11-07T10:40:11Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![TheErminK](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/theermink/32/33988_2.png) [@TheErminK](https://community.letsencrypt.org/u/TheErminK)\ **Post date:** [November 7, 2019, 10:40am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/1 "2019-11-07T10:40:11Z")
I would like to create automatic renwal for my domains, because i Have had some bad luck in the past without looking into it I have made some mistakes that cost me dearly. I would like to know if there is a tutorial or something similar to recommend me so i don’t mess everything up. Thank you. My domain is: www.elami.mk My web server is (include version): Distributor ID: Debian Description: Debian GNU/Linux 9.9 (stretch) Release: 9.9 Codename: stretch The operating system my web server runs on is (include version): Apache/2.4.25 (Debian) I can login to a root shell on my machine (yes or no, or I don’t know): YES I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No, I use terminal The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): certbot 0.40.1 (cannot find where is located) ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 7, 2019, 11:02am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/2 "2019-11-07T11:02:42Z")
> [@TheErminK](#): > > certbot 0.40.1 (cannot find where is located) `which certbot` `find / -name certbot` > [@TheErminK](#): > > I would like to create automatic renwal for my domains Please show: `systemctl status certbot` `systemctl list-timers certbot.timer` ---
**Author:** ![TheErminK](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/theermink/32/33988_2.png) [@TheErminK](https://community.letsencrypt.org/u/TheErminK)\ **Post date:** [November 7, 2019, 11:15am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/3 "2019-11-07T11:15:21Z")
`which certbot` `find / -name certbot` /opt/letsencrypt/certbot /opt/eff.org/certbot /opt/eff.org/certbot/venv/bin/certbot /opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot `systemctl status certbot` `systemctl list-timers certbot.timer` systemctl status certbot Unit certbot.service could not be found. systemctl list-timers certbot.timer 0 timers listed. Pass --all to see loaded but inactive timers, too. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 7, 2019, 11:31am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/4 "2019-11-07T11:31:24Z")
Please show: `find / -name certbot*` `systemctl list-timers` `#use your actual root username:` `crontab -u root -l` EDIT: be sure to be logged as root user or use `sudo` for these commands ---
**Author:** ![TheErminK](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/theermink/32/33988_2.png) [@TheErminK](https://community.letsencrypt.org/u/TheErminK)\ **Post date:** [November 7, 2019, 11:34am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/5 "2019-11-07T11:34:41Z")
> [@rg305](#): > > find / -name certbot\* # find / -name certbot\* /opt/letsencrypt/docs/man/certbot.rst /opt/letsencrypt/certbot-ci /opt/letsencrypt/certbot-ci/certbot\_integration\_tests /opt/letsencrypt/certbot-ci/certbot\_integration\_tests/utils/certbot\_call.py /opt/letsencrypt/certbot-ci/certbot\_integration\_tests/certbot\_tests /opt/letsencrypt/certbot-dns-luadns /opt/letsencrypt/certbot-dns-luadns/certbot\_dns\_luadns /opt/letsencrypt/certbot-dns-cloudflare /opt/letsencrypt/certbot-dns-cloudflare/certbot\_dns\_cloudflare /opt/letsencrypt/certbot-apache /opt/letsencrypt/certbot-apache/certbot\_apache /opt/letsencrypt/certbot-apache/certbot\_apache/tests/testdata/debian\_apache\_2\_4/ multiple\_vhosts/apache2/sites-available/certbot.conf /opt/letsencrypt/certbot-apache/certbot\_apache/tests/testdata/debian\_apache\_2\_4/ multiple\_vhosts/apache2/sites-enabled/certbot.conf /opt/letsencrypt/certbot-dns-route53 /opt/letsencrypt/certbot-dns-route53/certbot\_dns\_route53 /opt/letsencrypt/certbot /opt/letsencrypt/certbot-auto /opt/letsencrypt/certbot-dns-google /opt/letsencrypt/certbot-dns-google/certbot\_dns\_google /opt/letsencrypt/certbot-nginx /opt/letsencrypt/certbot-nginx/certbot\_nginx /opt/letsencrypt/certbot-dns-gehirn /opt/letsencrypt/certbot-dns-gehirn/certbot\_dns\_gehirn /opt/letsencrypt/certbot-dns-dnsmadeeasy /opt/letsencrypt/certbot-dns-dnsmadeeasy/certbot\_dns\_dnsmadeeasy /opt/letsencrypt/certbot-compatibility-test /opt/letsencrypt/certbot-compatibility-test/certbot\_compatibility\_test /opt/letsencrypt/certbot-dns-rfc2136 /opt/letsencrypt/certbot-dns-rfc2136/certbot\_dns\_rfc2136 /opt/letsencrypt/certbot-dns-ovh /opt/letsencrypt/certbot-dns-ovh/certbot\_dns\_ovh /opt/letsencrypt/certbot-dns-dnsimple /opt/letsencrypt/certbot-dns-dnsimple/certbot\_dns\_dnsimple /opt/letsencrypt/certbot-dns-digitalocean /opt/letsencrypt/certbot-dns-digitalocean/certbot\_dns\_digitalocean /opt/letsencrypt/letsencrypt-auto-source/certbot-auto.asc /opt/letsencrypt/letsencrypt-auto-source/pieces/certbot-requirements.txt /opt/letsencrypt/windows-installer/certbot.ico /opt/letsencrypt/examples/plugins/certbot\_example\_plugins.py /opt/letsencrypt/certbot-dns-sakuracloud /opt/letsencrypt/certbot-dns-sakuracloud/certbot\_dns\_sakuracloud /opt/letsencrypt/certbot-dns-linode /opt/letsencrypt/certbot-dns-linode/certbot\_dns\_linode /opt/letsencrypt/certbot-dns-cloudxns /opt/letsencrypt/certbot-dns-cloudxns/certbot\_dns\_cloudxns /opt/letsencrypt/certbot-dns-nsone /opt/letsencrypt/certbot-dns-nsone/certbot\_dns\_nsone /opt/eff.org/certbot /opt/eff.org/certbot/venv/bin/certbot /opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot\_nginx-0.40.1.dist- info /opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot\_apache-0.40.1.dist -info /opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot\_nginx /opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot /opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot-0.40.1.dist-info /opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot\_apache /opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot\_apache/tests/testd ata/debian\_apache\_2\_4/multiple\_vhosts/apache2/sites-available/certbot.conf /opt/eff.org/certbot/venv/lib/python2.7/site-packages/certbot\_apache/tests/testd ata/debian\_apache\_2\_4/multiple\_vhosts/apache2/sites-enabled/certbot.conf /opt/eff.org/certbot/venv/certbot-auto-bootstrap-version.txt /usr/local/sbin/certbot-auto > [@rg305](#): > > systemctl list-timers systemctl list-timers NEXT LEFT LAST PASSED UNIT ACTIVATES Thu 2019-11-07 11:39:00 UTC 5min left Thu 2019-11-07 11:09:02 UTC 24min ago phpsessionclean.timer phpsessionclean.service Thu 2019-11-07 14:47:11 UTC 3h 13min left Wed 2019-11-06 14:47:11 UTC 20h ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service Thu 2019-11-07 17:18:39 UTC 5h 45min left Thu 2019-11-07 05:44:48 UTC 5h 48min ago apt-daily.timer apt-daily.service Fri 2019-11-08 06:11:31 UTC 18h left Thu 2019-11-07 06:04:35 UTC 5h 28min ago apt-daily-upgrade.timer apt-daily-upgrade.service 4 timers listed. Pass --all to see loaded but inactive timers, too. > [@rg305](#): > > `#use your actual root username:` > `crontab -u root -l` # sudo crontab -u root -l no crontab for root ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 7, 2019, 11:38am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/6 "2019-11-07T11:38:14Z")
> [@TheErminK](#): > > /opt/letsencrypt/certbot > /opt/letsencrypt/certbot-auto > [@TheErminK](#): > > /usr/local/sbin/certbot-auto OK, so your running `certbot-auto` But there was not timer automatically created for renewals... [that should have been done for you] ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 7, 2019, 11:41am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/7 "2019-11-07T11:41:33Z")
OK, the simplest is to use `cron` What command are you currently using to renew? ---
**Author:** ![TheErminK](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/theermink/32/33988_2.png) [@TheErminK](https://community.letsencrypt.org/u/TheErminK)\ **Post date:** [November 7, 2019, 11:44am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/8 "2019-11-07T11:44:22Z")
I still havent needed to renew, the websites are younger than 90 days and just wanted to prepare ahead of time and set up automatic renewal and not mess anything up along the way, ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 7, 2019, 11:45am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/9 "2019-11-07T11:45:27Z")
OK. Here is a starting point for your cron renewal entry: ```auto 41 */12 * * * /usr/local/sbin/certbot-auto --apache -q --deploy-hook '/etc/init.d/apache2 restart' ``` Test that with: `/usr/local/sbin/certbot-auto --apache --deploy-hook '/etc/init.d/apache2 restart'` ---
**Author:** ![TheErminK](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/theermink/32/33988_2.png) [@TheErminK](https://community.letsencrypt.org/u/TheErminK)\ **Post date:** [November 7, 2019, 11:47am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/10 "2019-11-07T11:47:19Z")
> [@rg305](#): > > Here is a starting point for your cron renewal entry: > > ```nohighlight > > ``` I just copy all of this into terminal and run ? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 7, 2019, 11:48am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/11 "2019-11-07T11:48:31Z")
> [@TheErminK](#): > > I just copy all of this into terminal and run ? From cron job NO That requires using an editor (via `crontab -e`) [[https://www.ostechnix.com/a-beginners-guide-to-cron-jobs/](https://www.ostechnix.com/a-beginners-guide-to-cron-jobs/)] Start with the TEST command first - see if that "works". Try from terminal prompt: ```nohighlight sudo /usr/local/sbin/certbot-auto --apache --deploy-hook '/etc/init.d/apache2 restart' ``` ---
**Author:** ![TheErminK](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/theermink/32/33988_2.png) [@TheErminK](https://community.letsencrypt.org/u/TheErminK)\ **Post date:** [November 7, 2019, 11:55am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/12 "2019-11-07T11:55:14Z")
> [@rg305](#): > > ```nohighlight > sudo /usr/local/sbin/certbot-auto --apache --deploy-hook '/etc/init.d/apache2 restart' > > ``` I copy this command exactly like this and run it as sudo su ? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 7, 2019, 11:56am UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/13 "2019-11-07T11:56:47Z")
YES ---
**Author:** ![TheErminK](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/theermink/32/33988_2.png) [@TheErminK](https://community.letsencrypt.org/u/TheErminK)\ **Post date:** [November 7, 2019, 12:01pm UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/14 "2019-11-07T12:01:47Z")
sudo /usr/local/sbin/certbot-auto --apache --deploy-hook ’ /etc/init.d/apache2 restart’ Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator apache, Installer apache Which names would you like to activate HTTPS for? * * * 1: elami.mk 2: www.elami.nl 3: www.elami.mk * * * Select the appropriate numbers separated by commas and/or spaces, or leave input blank to select all options shown (Enter ‘c’ to cancel): An unexpected error occ urred: error: (4, ‘Interrupted system call’) Please see the logfiles in /var/log/letsencrypt for more details. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 7, 2019, 12:02pm UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/15 "2019-11-07T12:02:59Z")
So you don’t yet have a certificate? Enter “c” and cancel that. Show: `certbot-auto certificates` ---
**Author:** ![TheErminK](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/theermink/32/33988_2.png) [@TheErminK](https://community.letsencrypt.org/u/TheErminK)\ **Post date:** [November 7, 2019, 12:03pm UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/16 "2019-11-07T12:03:55Z")
certbot-auto certificates Saving debug log to /var/log/letsencrypt/letsencrypt.log * * * Found the following certs: Certificate Name: elami.mk Domains: elami.mk www.elami.mk Expiry Date: 2019-12-10 10:18:04+00:00 (VALID: 32 days) Certificate Path: /etc/letsencrypt/live/elami.mk/fullchain.pem Private Key Path: /etc/letsencrypt/live/elami.mk/privkey.pem Certificate Name: justsayingkiddo.nl Domains: justsayingkiddo.nl www.justsayingkiddo.nl Expiry Date: 2019-12-10 10:52:58+00:00 (VALID: 32 days) Certificate Path: /etc/letsencrypt/live/justsayingkiddo.nl/fullchain.pem Private Key Path: /etc/letsencrypt/live/justsayingkiddo.nl/privkey.pem Certificate Name: [kentivo.de](http://kentivo.de) Domains: [kentivo.de](http://kentivo.de) Expiry Date: 2019-12-12 10:45:26+00:00 (VALID: 34 days) Certificate Path: /etc/letsencrypt/live/kentivo.de/fullchain.pem Private Key Path: /etc/letsencrypt/live/kentivo.de/privkey.pem Certificate Name: [www.kentivo.de](http://www.kentivo.de) Domains: [www.kentivo.de](http://www.kentivo.de) kentivo.nl www.kentivo.nl Expiry Date: 2019-12-12 10:34:56+00:00 (VALID: 34 days) Certificate Path: /etc/letsencrypt/live/www.kentivo.de/fullchain.pem Private Key Path: /etc/letsencrypt/live/www.kentivo.de/privkey.pem EDIT: The other domains listed here were also listed up there but I deleted them because I thought they were not relevant, but they are apparently so they were on the list up there also. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 7, 2019, 12:06pm UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/17 "2019-11-07T12:06:07Z")
Interesting… You have certs, but certbot-auto doesn’t know where/how they are being used… Please show: `ls -l /etc/letsencrypt/renewal/` ---
**Author:** ![TheErminK](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/theermink/32/33988_2.png) [@TheErminK](https://community.letsencrypt.org/u/TheErminK)\ **Post date:** [November 7, 2019, 12:08pm UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/18 "2019-11-07T12:08:10Z")
> [@rg305](#): > > Please show: > `ls -l /etc/letsencrypt/renewal/` ls -l /etc/letsencrypt/renewal/ total 16 -rw-r--r-- 1 root root 499 Sep 11 11:18 elami.mk.conf -rw-r--r-- 1 root root 549 Sep 11 11:53 justsayingkiddo.nl.conf -rw-r--r-- 1 root root 509 Sep 13 11:45 kentivo.de.conf -rw-r--r-- 1 root root 529 Sep 13 11:34 www.kentivo.de.conf ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 7, 2019, 12:09pm UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/19 "2019-11-07T12:09:52Z")
Please show: [don’t show account numbers] `cat /etc/letsencrypt/renewal/elami.mk.conf` ---
**Author:** ![TheErminK](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/theermink/32/33988_2.png) [@TheErminK](https://community.letsencrypt.org/u/TheErminK)\ **Post date:** [November 7, 2019, 12:11pm UTC](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775/20 "2019-11-07T12:11:07Z")
> [@rg305](#): > > `cat /etc/letsencrypt/renewal/elami.mk.conf` cat /etc/letsencrypt/renewal/elami.mk.conf # renew\_before\_expiry = 30 days version = 0.38.0 archive\_dir = /etc/letsencrypt/archive/elami.mk cert = /etc/letsencrypt/live/elami.mk/cert.pem privkey = /etc/letsencrypt/live/elami.mk/privkey.pem chain = /etc/letsencrypt/live/elami.mk/chain.pem fullchain = /etc/letsencrypt/live/elami.mk/fullchain.pem # Options used in the renewal process [renewalparams] authenticator = apache installer = apache account = server = [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory) [Next page](https://community.letsencrypt.org/t/how-to-correctly-add-auto-renewal-debian-9-stretch/105775.md?page=2)