How to Renew a Let's Encrypt Certificate on Ubuntu

Let’s Encrypt certificates are not issued forever. They expire on a short cycle, so renewal has to work reliably if you want your site to stay trusted in browsers. On Ubuntu, Certbot is the most common tool used to manage and renew those certificates.

Most setups are meant to renew automatically, but it is still important to know how to check the renewal process manually and how to troubleshoot it when something goes wrong.

If Certbot is already installed and managing your certificate, the basic renewal command is simple. It checks all installed certificates and renews only the ones that are close to expiry.

This command is safe to run manually even if the certificate is not due yet.

Before trusting the automation, run a dry test. A dry run simulates the renewal process without actually issuing a new certificate. This is the best way to confirm that Certbot, your challenge method, and your server configuration are all working as expected.

If the dry run succeeds, your renewal path is usually in good shape.

On modern Ubuntu systems, Certbot is often configured to renew automatically through a systemd timer. On some setups, a cron job may be used instead. The exact mechanism depends on how Certbot was installed and how the server was configured.

If you want to verify that automation exists, check the active timer or scheduled job instead of assuming renewal will happen by itself forever.

In many common setups, Certbot can reload the web server automatically after successful renewal. But it is still worth checking that the new certificate is actually being used after renewal, especially if you rely on custom Nginx or Apache configuration.

If needed, you can reload the server manually after renewal.

The most common failures are DNS mismatches, broken webroot or challenge paths, ports 80 or 443 being blocked, or old server configuration that no longer matches the domain state. Renewal may also fail if the domain now points somewhere else or if the server block no longer serves the expected host correctly.

When renewal fails, Certbot’s output usually tells you whether it is a challenge validation issue, a permissions issue, or a configuration problem.

If you manage production sites manually, it helps to treat certificate renewal like a lightweight maintenance check. Confirm the dry run, confirm the timer or cron setup, and confirm the site still serves the updated certificate after renewal.

This small discipline prevents avoidable downtime later.

This article fits naturally with deployment and server-fix content. If you are setting up an Ubuntu production environment or troubleshooting server issues, the related guides below help tie the stack together.