Certbot Cheatsheet

Cheatsheet#certbot

Certbot Cheatsheet

Certbot is an automated, open-source tool developed by the Electronic Frontier Foundation (EFF) to obtain and renew Let's Encrypt SSL/TLS certificates for websites and server services via the ACME protocol.

Installation

The recommended installation method for Certbot across most Linux distributions is via Snapd, though native package managers can also be used.

Via Snap (Recommended)

# Ensure snapd is updated
sudo snap install core; sudo snap refresh core
 
# Install Certbot via snap
sudo snap install --classic certbot
 
# Create symlink for global binary access
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Via Package Manager

# Debian / Ubuntu (with Nginx / Apache plugins)
sudo apt update
sudo apt install certbot python3-certbot-nginx python3-certbot-apache
 
# RHEL / CentOS / AlmaLinux / Rocky Linux
sudo dnf install epel-release -y
sudo dnf install certbot python3-certbot-nginx python3-certbot-apache

Interactive Web Server Plugins

Automated mode: Certbot issues the certificate and automatically updates web server configuration files with HTTPS settings and redirects.

Nginx Plugin

# Issue certificate and auto-configure Nginx
sudo certbot --nginx -d example.com -d www.example.com
 
# Only obtain certificate, do not modify Nginx configs
sudo certbot certonly --nginx -d example.com -d www.example.com

Apache Plugin

# Issue certificate and auto-configure Apache
sudo certbot --apache -d example.com -d www.example.com
 
# Only obtain certificate, do not modify Apache configs
sudo certbot certonly --apache -d example.com -d www.example.com

Standalone & Webroot Modes (Without Auto-Config)

Webroot Mode (Zero Downtime)

Places temporary verification files inside the web server's public document root (requires existing web server running on port 80).

sudo certbot certonly --webroot \
  -w /var/www/html -d example.com -d www.example.com \
  --email [email protected] --agree-tos --non-interactive

Standalone Mode (Temporary Server)

Binds directly to port 80 to perform HTTP-01 verification. Web server (Nginx/Apache) must be temporarily stopped.

# Stop existing web server
sudo systemctl stop nginx
 
# Run standalone certbot
sudo certbot certonly --standalone \
  -d example.com -d www.example.com \
  --email [email protected] --agree-tos
 
# Restart web server
sudo systemctl start nginx

Wildcard Certificates (DNS-01 Challenge)

Wildcard certificates (*.example.com) require the DNS-01 challenge instead of HTTP-01.

Manual DNS TXT Record Challenge

sudo certbot certonly --manual --preferred-challenges dns \
  -d example.com -d "*.example.com"

Certbot will pause and prompt you to create a _acme-challenge.example.com DNS TXT record before proceeding.

Automated DNS Plugins (Cloudflare / Route53 / DigitalOcean)

Cloudflare Plugin Example

# Install plugin via snap
sudo snap install certbot-dns-cloudflare
 
# Create credentials file (/etc/letsencrypt/cloudflare.ini)
# dns_cloudflare_api_token = YOUR_CLOUDFLARE_API_TOKEN
chmod 600 /etc/letsencrypt/cloudflare.ini
 
# Issue wildcard certificate automatically
sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d example.com -d "*.example.com"

Key Types & Encryption Options

By default, Certbot uses ECDSA key algorithm.

# Request modern ECDSA certificate (secp384r1)
sudo certbot certonly --nginx -d example.com --key-type ecdsa
 
# Request legacy RSA certificate (4096-bit)
sudo certbot certonly --nginx -d example.com --key-type rsa --rsa-key-size 4096

Managing Certificates

List Active Certificates & Expiry Dates

sudo certbot certificates

Revoke a Certificate

sudo certbot revoke \
  --cert-path /etc/letsencrypt/live/example.com/cert.pem \
  --reason keycompromise

Delete Certificate Files

sudo certbot delete --cert-name example.com

Automatic Renewal & Deployment Hooks

Certbot certificates are valid for 90 days. Auto-renewal is triggered via cron or systemd timer.

Test Renewal Process (Dry Run)

# Verify renewal process without making changes
sudo certbot renew --dry-run

Manual Force Renewal

sudo certbot renew --force-renewal

Automated Post-Renewal Hooks

Reload services automatically when certificates are successfully renewed:

# Reload Nginx after renewal
sudo certbot renew --deploy-hook "systemctl reload nginx"
 
# Reload Postfix & Dovecot mail servers after renewal
sudo certbot renew --deploy-hook "systemctl reload postfix dovecot"

Systemd Timer Status

# Check if certbot systemd timer is active
sudo systemctl status certbot.timer

Certificate File Paths

Certbot stores active certificate symlinks in /etc/letsencrypt/live/DOMAIN/:

File Name	Purpose / Contents
`fullchain.pem`	Certificate + Intermediate CA chain (Used by Nginx `ssl_certificate`).
`privkey.pem`	Server Private Key (Used by Nginx `ssl_certificate_key`).
`cert.pem`	Server public certificate only.
`chain.pem`	Intermediate CA certificate chain only.

Troubleshooting & Common Fixes

Port 80 is already in use (Standalone Mode)
- Stop any process running on port 80 before using --standalone: sudo systemctl stop nginx or sudo fuser -k 80/tcp.
Too Many Requests / Rate Limit Hit
- Let's Encrypt limits to 5 failed validations per hour per account. Use --test-cert or --dry-run while debugging.
DNS Problem: NXDOMAIN looking up TXT (DNS-01 Challenge)
- Ensure DNS TXT record _acme-challenge has propagated using dig TXT _acme-challenge.example.com before pressing Enter during manual mode.

Cheatsheets