Renewing Certifcates: Apache on Windows 10

[MikeMcQ]

Welcome to the community @brisray Terrific first post.

@brisray

Before I run it without --dry-run, I have a few questions about using certbot certonly --webroot ...

1. Will it automatically check if the current certificate is close to its expiry date?
2. Am I going to get 1 certificate (as I currently do) or get 3 or 6 separate ones?
3. Apache currently points to the certbot/live folder symlinks. When I get the new certificates, will Apache need to be restarted to make use of them?
4. I recently upgraded from Certbot 1.32.0 to 2.6.0 and now it's asking me if I want to change from RSA to ECDSA. I take it this is a good thing, but will it make a difference to Apache and my installation?

1. You run certbot renew on a schedule to renew all your certs. It checks for expiry and by default renews 30 days before expiry. And, certbot renew --dry-run tests it
2. Yes, 1 cert for each certbot command
3. Yes, Apache needs at least a graceful reload (not a restart) to get fresh cert
4. ECDSA is generally a good thing unless you have specific requirements for an RSA cert

Adding on to #3, you could use the certbot option --deploy-hook to run the command to reload Apache. If you use this option when you request the cert (certonly webroot) it will store that in the renewal conf file for use by the certbot renew command