The certbot renew
command looks at every certificate and tries to renew only those that are less than 30 days away from expiring. This is designed in part for people who might have many different certificates on their servers, which may have been issued at different times.
Trying to renew when necessary is the idea here. Here are some reasons why we prefer this approach (attempt to renew once or twice per day, but only those certificates that are less than 30 days from expiring) to others:
compared to trying to renew on a specific day of the month: if the renewal fails for some reason, you won't try again for a full month (!); also, for people who have several different certificates from us, this will create more risk of running into rate limits
compared to trying to renew immediately before expiration: if the renewal fails for some reason, you won't have very much time to investigate the problem before the certificate expires
compared to trying to renew as soon as permitted (e.g. 1 week after issuance): this seems to create unnecessary load on our servers
If you run certbot renew
from cron once or twice per day, you shouldn't have trouble with rate limits because it will check every day, but not actually perform a renewal action most days. But you should get a renewal promptly 30 days before the certificate expires. If this doesn't happen or you get errors or you get a reminder from the Let's Encrypt CA, you then have some time to figure out what the problem is.
The 0 1 1 */2 *
time spec in crontab
which you mentioned in your very first post renews at 1:00 on the first day of even-numbered months, which is especially risky in terms of what happens if something goes wrong with the renewal for some reason.
So I would suggest something like
43 3 1 * * cd /usr/local/letsencrypt && ./certbot-auto renew
The renew
subcommand is meant to be as convenient and automated as possible for unattended automated renewals. We have also asked people to choose a random minute for their automated renewals so that we don't get unnecessary load spikes at the beginning of every hour (so that's why I said 43 here).
You can learn more about crontab
by reading the manual page (man crontab
). The fields are minute, hour, day, month, day of week, command. (Some crontabs
come with a comment explaining this!) A *
means "every" (e.g. a *
for day means "every day").