# Will Let's Encrypt renew itself with the following crontab? **URL:** \ **Category:** Help\ **Created:** [January 25, 2022, 3:17am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376 "2022-01-25T03:17:47Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![NielD](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nield/32/57345_2.png) [@NielD](https://community.letsencrypt.org/u/NielD)\ **Post date:** [January 25, 2022, 3:17am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/1 "2022-01-25T03:17:48Z")
Hello This is a follow-up question for the following topic: [Wildcard SSL certificate with auto-renew](https://community.letsencrypt.org/t/wildcard-ssl-certificate-with-auto-renew/169481). It seemed that my local DNS-provider had a custom-made Bash-script which could be used in combination with Acme.sh to interact with their own DNS-API. With the following command I successfully generated my Let's Encrypt certificate: ```nohighlight acme.sh --issue -d example.com -d *.example.com --dns dns_tigron ``` It generated a long output ending with: ```nohighlight [Tue 25 Jan 2022 03:04:45 AM CET] Your cert is in: /root/.acme.sh/example.com/example.com.cer [Tue 25 Jan 2022 03:04:45 AM CET] Your cert key is in: /root/.acme.sh/example.com/example.com.key [Tue 25 Jan 2022 03:04:45 AM CET] The intermediate CA cert is in: /root/.acme.sh/example.com/ca.cer [Tue 25 Jan 2022 03:04:45 AM CET] And the full chain certs is there: /root/.acme.sh/example.com/fullchain.cer ``` And I linked it to my Nginx by adding the following lines to `nginx.conf`: ```nohighlight ... ssl_certificate /root/.acme.sh/example.com/fullchain.cer; ssl_certificate_key /root/.acme.sh/example.com/example.com.key; ... ``` This works perfectly! My website is now accessible by HTTPS. However, does this mean I never have to think about my SSL-certificate anymore? Or will there be problems in 60 days when the certificate is expired? Acme.sh added the following to my cronjob: ```nohighlight 6 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null ``` Is that sufficient to automatically renew my SSL certificates? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 25, 2022, 4:03am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/2 "2022-01-25T04:03:34Z")
It depends. I'm not familiar with: > [@NielD](#): > > `--dns dns_tigron` Was that a fully automated issuance? Was it a one-time use or did it require any _manual assistance_? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 25, 2022, 6:54am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/3 "2022-01-25T06:54:06Z")
Note that acme.sh defaults to the ZeroSSL CA nowadays, not Let's Encrypt. ---
**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\ **Post date:** [January 25, 2022, 6:59am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/4 "2022-01-25T06:59:11Z")
You need to use the `--install-cert` with `--reloadcmd` parameter, so that it can reload/restart your nginx when renewal. > **[GitHub - acmesh-official/acme.sh: A pure Unix shell script implementing ACME...](https://github.com/acmesh-official/acme.sh#3-install-the-cert-to-apachenginx-etc)** > > A pure Unix shell script implementing ACME client protocol - GitHub - acmesh-official/acme.sh: A pure Unix shell script implementing ACME client protocol ```nohighlight acme.sh --install-cert -d example.com --reloadcmd "service nginx force-reload" ``` ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [January 25, 2022, 12:01pm UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/5 "2022-01-25T12:01:30Z")
That's not really much of an issue. I realized when I had to make a cert for a new subdomain. I issued the command. And then I waited. I waited a lot. I Ctrl-C'd the process. I issued the command again, with Let's Encrypt this time. I didn't wait. It was instant. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 25, 2022, 1:52pm UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/6 "2022-01-25T13:52:12Z")
> [@9peppe](#): > > I issued the command. And then I waited. I waited a lot. I Ctrl-C'd the process. I issued the command again, with Let's Encrypt this time. I didn't wait. It was instant. From experience I too have noticed a big difference in speed between the two ACME servers indeed. ---
**Author:** ![NielD](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nield/32/57345_2.png) [@NielD](https://community.letsencrypt.org/u/NielD)\ **Post date:** [January 26, 2022, 1:52am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/7 "2022-01-26T01:52:39Z")
The only 'manual' thing I had to do is making a global shell variable holding some token I had to make in the adminpanel of my DNS-provider. Than I executed the command from my original post, and the certificate files were generated automatically. ---
**Author:** ![NielD](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nield/32/57345_2.png) [@NielD](https://community.letsencrypt.org/u/NielD)\ **Post date:** [January 26, 2022, 1:53am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/8 "2022-01-26T01:53:37Z")
Yeah I noticed. I got a timeout error using ZeroSSL. I executed the following command before issuing my certificates. ```nohighlight acme.sh --set-default-ca --server letsencrypt ``` ---
**Author:** ![NielD](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nield/32/57345_2.png) [@NielD](https://community.letsencrypt.org/u/NielD)\ **Post date:** [January 26, 2022, 1:54am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/9 "2022-01-26T01:54:59Z")
Do I have to execute that command once on my VPS. Or do I have to put it in the cronjob manually? ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [January 26, 2022, 9:36pm UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/10 "2022-01-26T21:36:59Z")
That's a command you only run once per certificate. It does something very simple and very important, it tells acme.sh where to put your certificate and key, and what command to issue to make your webserver realize they've been renewed. I say once per certificate because you might have more than one certificate on your server, for multiple subdomains using SAN, for example, or two certificates, RSA and ECC for the same domain. the acme.sh help says, about a cronjob: > --install-cronjob > Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job. ---
**Author:** ![NielD](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nield/32/57345_2.png) [@NielD](https://community.letsencrypt.org/u/NielD)\ **Post date:** [January 26, 2022, 9:49pm UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/11 "2022-01-26T21:49:39Z")
Okay. So I just need to do exactly what I did in my original post, put only add the `--instal-cert` and --reloadcmd "..."`parameters to my command. I don't need to`--issue` them again? Or are issuing and installing different operations? What is the difference between installing and issuing then? ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [January 26, 2022, 9:53pm UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/12 "2022-01-26T21:53:11Z")
Issue is actually making the certificate. It's an interaction between your client and Let's Encrypt servers. Install happens completely on your server. It's just for your convenience and it copies your cert and key to some location on your machine where your webserver can read them, it can also reload the webserver to make it realize they've been renewed. Talking about installing, please notice that acme.sh **will not** edit your nginx config to install the certificate, it will just copy the certificate and key and reload the service. You have to edit the configuration file for nginx yourself. ---
**Author:** ![NielD](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nield/32/57345_2.png) [@NielD](https://community.letsencrypt.org/u/NielD)\ **Post date:** [January 26, 2022, 9:59pm UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/13 "2022-01-26T21:59:49Z")
Sorry for my questions, and thank you for your patience. But I am not really following. After executing this command `acme.sh --issue -d example.com -d *.example.com --dns dns_tigron` acme.sh automatically putted all the files for my certificate in `/root/.acme.sh/example.com/`. I manually edited my Nginx to link to those certificate-files. My cronjob now contains the command to issue the certificates again, right? Wouldn't it be sufficient then to only add a command to restart nginx after the issuing then? > It's just for your convenience and it copies your cert and key to some location on your machine where your webserver can read them Acme.sh does not have to move or copy the files to another location. Nginx can already find them. > it can also reload the webserver to make it realize they've been renewed. This would be handy. Can I do that without Acme.sh moving/copying my certificate files? ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [January 26, 2022, 10:06pm UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/14 "2022-01-26T22:06:35Z")
> [@NielD](#): > > My cronjob now contains the command to issue the certificates again, right? It should call acme.sh and it will check if they need renewing, doing so if necessary. You can check. `crontab -l` > [@NielD](#): > > Wouldn't it be sufficient then to only add a command to restart nginx after the issuing then? You don't want to restart nginx, it will drop all active connections. You just need to reload it. Also, you only renew the certificate every two months, there is no point in reloading nginx twice a day because of this. > [@NielD](#): > > Acme.sh does not have to move or copy the files to another location. Nginx can already find them. Yes, but it can be cleaner. You could put a copy of the certificate in `/etc/nginx/ssl` or someplace similar. > [@NielD](#): > > Can I do that without Acme.sh moving/copying my certificate files? Yes, the command Neil gave you does exactly this. I was thinking of two more options, `--fullchain-file` and `--key-file` ---
**Author:** ![NielD](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nield/32/57345_2.png) [@NielD](https://community.letsencrypt.org/u/NielD)\ **Post date:** [January 29, 2022, 5:07am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/15 "2022-01-29T05:07:16Z")
Okay. So to summarize everything. In the configuration I am now (working HTTPS and the situation described in my OP) the only command I have to execute is: `acme.sh --install-cert -d example.com --reloadcmd "service nginx force-reload"` And I am fine? I do not have to do the issuing again? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 29, 2022, 10:15am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/17 "2022-01-29T10:15:14Z")
> [@NielD](#): > > And I am fine? I do not have to do the issuing again? Have a look at the output of: `acme.sh --list` If the name(s) you need covered are listed, you don't need to reissue (an existing cert). `cron` should run `acme.sh` to renew any expiring certs. ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [January 29, 2022, 11:56am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/18 "2022-01-29T11:56:00Z")
assuming the `-d example.com` part is correct, yes. your cert is an RSA one, right? if you're using elliptic curves you need to add an `--ecc` option as well. (Probably not. What did you put for `--keylength` when you issued the certificate? If you didn't set one, ignore this paragraph.) * * * I don't know why "force-reload" instead of just "reload", actually. ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [January 29, 2022, 1:49pm UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/19 "2022-01-29T13:49:29Z")
> [@NielD](#): > > --reloadcmd "service nginx force-reload" Like @9peppe, I'm wondering why you'd do force-reload rather than just reload--in most environments, a reload will do what's needed. I don't know that force-reload would hurt anything, but I also don't think it'd be necessary. ---
**Author:** ![NielD](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/nield/32/57345_2.png) [@NielD](https://community.letsencrypt.org/u/NielD)\ **Post date:** [January 30, 2022, 2:49am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/20 "2022-01-30T02:49:14Z")
Command I executed and it's output: ```nohighlight root@example:/home/example/.acme.sh# acme.sh --install-cert -d example.com -d *.example.com --reloadcmd "systemctl reload nginx" [Sun 30 Jan 2022 03:46:38 AM CET] Run reload cmd: systemctl reload nginx [Sun 30 Jan 2022 03:46:38 AM CET] Reload success root@example:/home/example/.acme.sh# ``` `crontab -l` output: ```nohighlight 6 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null ``` `acme.sh --list` output: ```nohighlight Main_Domain KeyLength SAN_Domains CA Created Renew example.com "" *.example.com LetsEncrypt.org Tue 25 Jan 2022 02:04:45 AM UTC Sat 26 Mar 2022 02:04:45 AM UTC ``` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 30, 2022, 4:22am UTC](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376/21 "2022-01-30T04:22:02Z")
Everything looks normal. [Next page](https://community.letsencrypt.org/t/will-lets-encrypt-renew-itself-with-the-following-crontab/170376.md?page=2)