For using in automated cronjob based ssl cert renewals which would be a better option --keep-until-renewal or --renew-by-default ?
for --keep-until-renewal is that literally keep until day of expiry or there’s preset number of days before expiry ?
The default for --keep-until-expiring (I’m assuming you mean that one) is to renew 30 days before expiration. --renew-by-default will always issue a new certificate.
The main advantage of using --keep-until-expiring is that you can simply run the cron daily and it will handle the “renew after 60 days” recommendation for you (without having to add your own checks or more complicated cron rules).
Additionally, it’s going to be more resilient to run a daily cronjob in case of intermittent errors as opposed to running it once every 30, 60 or 90 days. If something goes wrong on day 60 since your last renewal due to e.g. an outage, it’s likely it will work on the next day or at least at some point before the certificate expires.
actually i did mean --keep-until-renewal but now there’s another to decide on --keep-until-expiring 
when is --keep-until-renewal used ?
Where did you find that switch? cli.py doesn't know it: https://github.com/letsencrypt/letsencrypt/blob/master/letsencrypt/cli.py
Ah, well, perhaps the documentation is outdated or wasn’t correct in the first place, because --keep is a synonym for --keep-until-expiring:
https://github.com/letsencrypt/letsencrypt/blob/master/letsencrypt/cli.py#L973
Hmm, as far as I can tell, it’s always been --keep-until-expiring:
yeah got --keep-until-renewal from https://letsencrypt.org/howitworks/#writing-your-own-renewal-script so that’s why i asked as can’t find any reference to it anywhere
