Understanding certbot renew

@ivo,

I don't know what you mean by test. The first time you want to issue a certificate, Let's Encrypt needs to validate that you own the domain(s) so it uses a challenge, for example the http challenge, it puts a file with a specific content inside ./well-known/acme-challenge/ dir inside your domain document root. Let's Encrypt knows whath is the file that should try to reach and the content of this file, if Let's Encrypt can get this file from its side that means that you have proved that you control that domain and Let's Encrypt has validated it and issues a cert for your domain.

Let's Encrypt saves that authorization for your domain and keeps it for 30 days. If for whatever reason you want to renew your cert just 5 days after you issued the first one, Let's Encrypt won't try to reach your domain again to review the specific file in ./well-known/acme-challenge/ dir, as the authorization is still valid it will issue a new cert for your domain but as it has not validated again, the lifetime authorization for your domain is 25 days.

The certificates are valid for 90 days and Let's Encrypt recommends to renew them after 60 days so if something goes wrong you still have 30 days to fix any issue so if you try to renew your cert 60 days after you issued it, the validated authorization has expired and Let's Encrypt will try to prove that you still control the domain and will perform again the same procedure... check the file on ./well-known/acme-challenge/ so once checked you have a new valid authorization for 30 days and Let's Encrypt will be able to issue a new cert for you.

There is no need to perform any test nor other action to revalidate your authorization, just issue your cert, and renew it when you want.

If you are worried because you issued your certificate and after that you changed the document root, then the command certbot renew will place the challenge in the wrong dir, to solve this you could edit the file /etc/letsencrypt/renewal/yourdomain.conf and change in this file the old document root with the new one so certbot renew command will use the right path to place the challenge.

You can read this post from @jsha (Let's Encrypt boulder engineer) Failed validation limit, validation IP addresses, and authorization lifetime and this one Expiry of valid authorizations reduced from 60 days to 30 days where he announces that valid authorizations have been reduced from 60 to 30 days.

Cheers,
sahsanu

3 Likes