neulab/tldr huggingface dataset:
System Requirements Certbot currently requires Python 2.7 or 3.6+ running on a UNIX-like operating system. By default, it requires root access in order to write to /etc/letsencrypt, /var/log/letsencrypt, /var/lib/letsencrypt; to bind to port 80 (if you use the standalone plugin) and to read and modify webserver configurations (if you use the apache or nginx plugins).  If none of these apply to you, it is theoretically possible to run without root privileges, but for most users who want to avoid running an ACME client as root, either letsencrypt-nosudo or simp_le are more appropriate choices.
The Apache plugin currently requires an OS with augeas version 1.0; currently it supports modern OSes based on Debian, Ubuntu, Fedora, SUSE, Gentoo and Darwin.
Additional integrity verification of certbot-auto script can be done by verifying its digital signature.  This requires a local installation of gpg2, which comes packaged in many Linux distributions under name gnupg or gnupg2.
Installing with certbot-auto requires 512MB of RAM in order to build some of the dependencies. Installing from pre-built OS packages avoids this requirement. You can also temporarily set a swap file. See "Problems with Python virtual environment" below for details.
Alternate installation methods If you are offline or your operating system doesn't provide a package, you can use an alternate method for installing certbot.
Snap Most modern Linux distributions (basically any that use systemd) can install Certbot packaged as a snap. Snaps are available for x86_64, ARMv7 and ARMv8 architectures. The Certbot snap provides an easy way to ensure you have the latest version of Certbot with features like automated certificate renewal preconfigured.
You can find instructions for installing the Certbot snap at https://certbot.eff.org/instructions by selecting your server software and then choosing "snapd" in the "System" dropdown menu. (You should select "snapd" regardless of your operating system, as our instructions are the same across all systems.)
Certbot-Auto The certbot-auto wrapper script installs Certbot, obtaining some dependencies from your web server OS and putting others in a python virtual environment. You can download and run it as follows:
wget https://dl.eff.org/certbot-auto sudo mv certbot-auto /usr/local/bin/certbot-auto sudo chown root /usr/local/bin/certbot-auto sudo chmod 0755 /usr/local/bin/certbot-auto /usr/local/bin/certbot-auto --help
To remove certbot-auto, just delete it and the files it places under /opt/eff.org, along with any cronjob or systemd timer you may have created.
To check the integrity of the certbot-auto script, you can use these steps:
user@webserver:~$ wget -N https://dl.eff.org/certbot-auto.asc user@webserver:~$ gpg2 --keyserver pool.sks-keyservers.net --recv-key A2CFB51FA275A7286234E7B24D17C995CD9775F2 user@webserver:~$ gpg2 --trusted-key 4D17C995CD9775F2 --verify certbot-auto.asc /usr/local/bin/certbot-auto
The output of the last command should look something like:
gpg: Signature made Wed 02 May 2018 05:29:12 AM IST gpg:                using RSA key A2CFB51FA275A7286234E7B24D17C995CD9775F2 gpg: key 4D17C995CD9775F2 marked as ultimately trusted gpg: checking the trustdb gpg: marginals needed: 3  completes needed: 1  trust model: pgp gpg: depth: 0  valid:   2  signed:   2  trust: 0-, 0q, 0n, 0m, 0f, 2u gpg: depth: 1  valid:   2  signed:   0  trust: 2-, 0q, 0n, 0m, 0f, 0u gpg: next trustdb check due at 2027-11-22 gpg: Good signature from "Let's Encrypt Client Team <letsencrypt-client@eff.org>" [ultimate]
The certbot-auto command updates to the latest client release automatically.  Since certbot-auto is a wrapper to certbot, it accepts exactly the same command line flags and arguments. For more information, see Certbot command-line options.
For full command line help, you can type:
/usr/local/bin/certbot-auto --help all
Problems with Python virtual environment On a low memory system such as VPS with less than 512MB of RAM, the required dependencies of Certbot will fail to build.  This can be identified if the pip outputs contains something like internal compiler error: Killed (program cc1).  You can workaround this restriction by creating a temporary swapfile:
user@webserver:~$ sudo fallocate -l 1G /tmp/swapfile user@webserver:~$ sudo chmod 600 /tmp/swapfile user@webserver:~$ sudo mkswap /tmp/swapfile user@webserver:~$ sudo swapon /tmp/swapfile
Disable and remove the swapfile once the virtual environment is constructed:
user@webserver:~$ sudo swapoff /tmp/swapfile user@webserver:~$ sudo rm /tmp/swapfile
Running with Docker Docker is an amazingly simple and quick way to obtain a certificate. However, this mode of operation is unable to install certificates or configure your webserver, because our installer plugins cannot reach your webserver from inside the Docker container.
Most users should use the instructions at certbot.eff.org. You should only use Docker if you are sure you know what you are doing and have a good reason to do so.
You should definitely read the where-certs section, in order to know how to manage the certs manually. Our ciphersuites page provides some information about recommended ciphersuites. If none of these make much sense to you, you should definitely use the installation method recommended for your system at certbot.eff.org, which enables you to use installer plugins that cover both of those hard topics.
If you're still not convinced and have decided to use this method, from the server that the domain you're requesting a certficate for resolves to, install Docker, then issue a command like the one found below. If you are using Certbot with the Standalone plugin, you will need to make the port it uses accessible from outside of the container by including something like -p 80:80 or -p 443:443 on the command line before certbot/certbot.
sudo docker run -it --rm --name certbot \ -v "/etc/letsencrypt:/etc/letsencrypt" \ -v "/var/lib/letsencrypt:/var/lib/letsencrypt" \ certbot/certbot certonly
Running Certbot with the certonly command will obtain a certificate and place it in the directory /etc/letsencrypt/live on your system. Because Certonly cannot install the certificate from within Docker, you must install the certificate manually according to the procedure recommended by the provider of your webserver.
There are also Docker images for each of Certbot's DNS plugins available at https://hub.docker.com/u/certbot which automate doing domain validation over DNS for popular providers. To use one, just replace certbot/certbot in the command above with the name of the image you want to use. For example, to use Certbot's plugin for Amazon Route 53, you'd use certbot/dns-route53. You may also need to add flags to Certbot and/or mount additional directories to provide access to your DNS API credentials as specified in the DNS plugin documentation.
For more information about the layout of the /etc/letsencrypt directory, see where-certs.
Operating System Packages Arch Linux
sudo pacman -S certbot
If you run Debian Buster or Debian testing/Sid, you can easily install certbot packages through commands like:
sudo apt-get update sudo apt-get install certbot
If you run Debian Stretch, we recommend you use the packages in Debian backports repository. First you'll have to follow the instructions at https://backports.debian.org/Instructions/ to enable the Stretch backports repo, if you have not already done so. Then run:
sudo apt-get install certbot -t stretch-backports
In all of these cases, there also packages available to help Certbot integrate with Apache, nginx, or various DNS services. If you are using Apache or nginx, we strongly recommend that you install the python-certbot-apache or python-certbot-nginx package so that Certbot can fully automate HTTPS configuration for your server. A full list of these packages can be found through a command like:
apt search 'python-certbot*'
They can be installed by running the same installation command above but replacing certbot with the name of the desired package.
If you run Ubuntu, certbot can be installed using:
sudo apt-get install certbot
Optionally to install the Certbot Apache plugin, you can use:
sudo apt-get install python-certbot-apache
sudo dnf install certbot python2-certbot-apache
• Port: cd /usr/ports/security/py-certbot && make install clean
• Package: pkg install py27-certbot
The official Certbot client is available in Gentoo Portage. From the official Certbot plugins, three of them are also available in Portage. They need to be installed separately if you require their functionality.
emerge -av app-crypt/certbot emerge -av app-crypt/certbot-apache emerge -av app-crypt/certbot-nginx emerge -av app-crypt/certbot-dns-nsone
NOTE: The app-crypt/certbot-dns-nsone package has a different maintainer than the other packages and can lag behind in version.
• Build from source: cd /usr/pkgsrc/security/py-certbot && make install clean
• Install pre-compiled package: pkg_add py27-certbot
• Port: cd /usr/ports/security/letsencrypt/client && make install clean
• Package: pkg_add letsencrypt
OS packaging is an ongoing effort. If you'd like to package Certbot for your distribution of choice please have a look at the packaging.
Installing from source Installation from source is only supported for developers and the whole process is described in the contributing.
WARNING: Please do not use python certbot/setup.py install, python pip install certbot, or easy_install certbot. Please do not attempt the installation commands as superuser/root and/or without virtual environment, e.g. sudo python certbot/setup.py install, sudo pip install, sudo system and are not supported by the Certbot team!
Table of Contents • Certbot Commands
• Getting certificates (and choosing plugins)
• Apache
• Webroot
• Nginx
• Standalone
• DNS Plugins
• Combining plugins
• Third-party plugins
• Managing certificates
• Re-creating and Updating Existing Certificates
• Changing a Certificate's Domains
• Using ECDSA keys
• Changing existing certificates from RSA to ECDSA
• Obtaining ECDSA certificates in addition to RSA certificates
• Revoking certificates
• Renewing certificates
• Modifying the Renewal Configuration File
• Automated Renewals
• Where are my certificates?
• Pre and Post Validation Hooks
• Changing the ACME Server
• Lock Files
• Configuration file
• Log Rotation
• Certbot command-line options
• Getting help
Certbot Commands Certbot uses a number of different commands (also referred to as "subcommands") to request specific actions such as obtaining, renewing, or revoking certificates. The most important and commonly-used commands will be discussed throughout this document; an exhaustive list also appears near the end of the document.
The certbot script on your web server might be named letsencrypt if your system uses an older package, or certbot-auto if you used an alternate installation method. Throughout the docs, whenever you see certbot, swap in the correct name as needed.
Getting certificates (and choosing plugins) The Certbot client supports two types of plugins for obtaining and installing certificates: authenticators and installers.
Authenticators are plugins used with the certonly command to obtain a certificate.  The authenticator validates that you control the domain(s) you are requesting a certificate for, obtains a certificate for the specified domain(s), and places the certificate in the /etc/letsencrypt directory on your machine. The authenticator does not install the certificate (it does not edit any of your server's configuration files to serve the obtained certificate). If you specify multiple domains to authenticate, they will all be listed in a single certificate. To obtain multiple separate certificates you will need to run Certbot multiple times.
Installers are Plugins used with the install command to install a certificate.  These plugins can modify your webserver's configuration to serve your website over HTTPS using certificates obtained by certbot.
Plugins that do both can be used with the certbot run command, which is the default when no command is specified. The run subcommand can also be used to specify a combination of distinct authenticator and installer plugins.
┌────────────┬──────┬──────┬───────────────────────────────────────────────────────────────┬──────────────┐
│Plugin      │ Auth │ Inst │ Notes                                                         │ Challenge    │
│            │      │      │                                                               │ types (and   │
│            │      │      │                                                               │ port)        │
├────────────┼──────┼──────┼───────────────────────────────────────────────────────────────┼──────────────┤
│apache      │ Y    │ Y    │ Automates obtaining and installing a certificate with Apache. │ http-01 (80) │
├────────────┼──────┼──────┼───────────────────────────────────────────────────────────────┼──────────────┤
│nginx       │ Y    │ Y    │ Automates obtaining and installing a certificate with Nginx.  │ http-01 (80) │
├────────────┼──────┼──────┼───────────────────────────────────────────────────────────────┼──────────────┤
│webroot     │ Y    │ N    │ Obtains a certificate by writing to the webroot directory of  │ http-01 (80) │
│            │      │      │ an already running webserver.                                 │              │
├────────────┼──────┼──────┼───────────────────────────────────────────────────────────────┼──────────────┤
│standalone  │ Y    │ N    │ Uses a "standalone" webserver to obtain a certificate.        │ http-01 (80) │
│            │      │      │ Requires port 80 to be available. This is useful on           │              │
│            │      │      │ systems with no webserver, or when direct integration with    │              │
│            │      │      │ the local webserver is not supported or not desired.          │              │
├────────────┼──────┼──────┼───────────────────────────────────────────────────────────────┼──────────────┤
│DNS plugins │ Y    │ N    │ This category of plugins automates obtaining a certificate by │ dns-01 (53)  │
│            │      │      │ modifying DNS records to prove you have control over a        │              │
│            │      │      │ domain. Doing domain validation in this way is                │              │
│            │      │      │ the only way to obtain wildcard certificates from Let's       │              │
│            │      │      │ Encrypt.                                                      │              │
├────────────┼──────┼──────┼───────────────────────────────────────────────────────────────┼──────────────┤
│manual      │ Y    │ N    │ Helps you obtain a certificate by giving you instructions to  │ http-01 (80) │
│            │      │      │ perform domain validation yourself. Additionally allows you   │ or dns-01    │
│            │      │      │ to specify scripts to automate the validation task in a       │ (53)         │
│            │      │      │ customized way.                                               │              │
└────────────┴──────┴──────┴───────────────────────────────────────────────────────────────┴──────────────┘
Under the hood, plugins use one of several ACME protocol challenges to prove you control a domain. The options are http-01 (which uses port 80) and dns-01 (requiring configuration of a DNS server on port 53, though that's often not the same machine as your webserver). A few plugins support more than one challenge type, in which case you can choose one with --preferred-challenges.
There are also many third-party-plugins available. Below we describe in more detail the circumstances in which each plugin can be used, and how to use it.
Apache The Apache plugin currently supports modern OSes based on Debian, Fedora, SUSE, Gentoo and Darwin.  This automates both obtaining and installing certificates on an Apache webserver. To specify this plugin on the command line, simply include --apache.
Webroot If you're running a local webserver for which you have the ability to modify the content being served, and you'd prefer not to stop the webserver during the certificate issuance process, you can use the webroot plugin to obtain a certificate by including certonly and --webroot on the command line. In addition, you'll need to specify --webroot-path or -w with the top-level directory ("web root") containing the files served by your webserver. For example, --webroot-path /var/www/html or --webroot-path /usr/share/nginx/html are two common webroot paths.
If you're getting a certificate for many domains at once, the plugin needs to know where each domain's files are served from, which could potentially be a separate directory for each domain. When requesting a certificate for multiple domains, each domain will use the most recently specified --webroot-path. So, for instance,
certbot certonly --webroot -w /var/www/example -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net
would obtain a single certificate for all of those names, using the /var/www/example webroot directory for the first two, and /var/www/other for the second two.
The webroot plugin works by creating a temporary file for each of your requested domains in ${webroot-path}/.well-known/acme-challenge. Then the Let's Encrypt validation server makes HTTP requests to validate that the DNS for each requested domain resolves to the server running certbot. An example request made to your web server would look like:
66.133.109.36 - - [05/Jan/2016:20:11:24 -0500] "GET /.well-known/acme-challenge/HGr8U1IeTW4kY_Z6UIyaakzOkyQgPr_7ArlLgtZE8SX HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
Note that to use the webroot plugin, your server must be configured to serve files from hidden directories. If /.well-known is treated specially by your webserver configuration, you might need to modify the configuration to ensure that files inside /.well-known/acme-challenge are served by the webserver.
Nginx The Nginx plugin should work for most configurations. We recommend backing up Nginx configurations before using it (though you can also revert changes to configurations with certbot --nginx rollback). You can use it by providing the --nginx flag on the commandline.
certbot --nginx
Standalone Use standalone mode to obtain a certificate if you don't want to use (or don't currently have) existing server software. The standalone plugin does not rely on any other server software running on the machine where you obtain the certificate.
To obtain a certificate using a "standalone" webserver, you can use the standalone plugin by including certonly and --standalone on the command line. This plugin needs to bind to port 80 in order to perform domain validation, so you may need to stop your existing webserver.
It must still be possible for your machine to accept inbound connections from the Internet on the specified port using each requested domain name.
By default, Certbot first attempts to bind to the port for all interfaces using IPv6 and then bind to that port using IPv4; Certbot continues so long as at least one bind succeeds. On most Linux systems, IPv4 traffic will be routed to the bound IPv6 port and the failure during the second bind is expected.
Use --<challenge-type>-address to explicitly tell Certbot which interface (and protocol) to bind.
DNS Plugins If you'd like to obtain a wildcard certificate from Let's Encrypt or run certbot on a machine other than your target webserver, you can use one of Certbot's DNS plugins.
These plugins are not included in a default Certbot installation and must be installed separately. While the DNS plugins cannot currently be used with certbot-auto, they are available in many OS package managers, as Docker images, and as snaps. Visit https://certbot.eff.org to learn the best way to use the DNS plugins on your system.
Once installed, you can find documentation on how to use each plugin at:
• certbot-dns-cloudflare
• certbot-dns-cloudxns
• certbot-dns-digitalocean
• certbot-dns-dnsimple
• certbot-dns-dnsmadeeasy
• certbot-dns-gehirn
• certbot-dns-google
• certbot-dns-linode
• certbot-dns-luadns
• certbot-dns-nsone
• certbot-dns-ovh
• certbot-dns-rfc2136
• certbot-dns-route53
• certbot-dns-sakuracloud
Manual If you'd like to obtain a certificate running certbot on a machine other than your target webserver or perform the steps for domain validation yourself, you can use the manual plugin. While hidden from the UI, you can use the plugin to obtain a certificate by specifying certonly and --manual on the command line. This requires you to copy and paste commands into another terminal session, which may be on a different computer.
The manual plugin can use either the http or the dns challenge. You can use the --preferred-challenges option to choose the challenge of your preference.
The http challenge will ask you to place a file with a specific name and specific content in the /.well-known/acme-challenge/ directory directly in the top-level directory (“web root”) containing the files served by your webserver. In essence it's the same as the webroot plugin, but not automated.
When using the dns challenge, certbot will ask you to place a TXT DNS record with specific contents under the domain name consisting of the hostname for which you want a certificate issued, prepended by _acme-challenge.
For example, for the domain example.com, a zone file entry would look like:
_acme-challenge.example.com. 300 IN TXT "gfj9Xq...Rg85nM"
Additionally you can specify scripts to prepare for validation and perform the authentication procedure and/or clean up after it by using the --manual-auth-hook and --manual-cleanup-hook flags. This is described in more depth in the hooks section.
Combining plugins Sometimes you may want to specify a combination of distinct authenticator and installer plugins. To do so, specify the authenticator plugin with --authenticator or -a and the installer plugin with --installer or -i.
For instance, you could create a certificate using the webroot plugin for authentication and the apache plugin for installation.
certbot run -a webroot -i apache -w /var/www/html -d example.com
Or you could create a certificate using the manual plugin for authentication and the nginx plugin for installation. (Note that this certificate cannot be renewed automatically.)
certbot run -a manual -i nginx -d example.com
Third-party plugins There are also a number of third-party plugins for the client, provided by other developers. Many are beta/experimental, but some are already in widespread use:
┌───────────────┬──────┬──────┬──────────────────┐ │Plugin         │ Auth │ Inst │ Notes            │ ├───────────────┼──────┼──────┼──────────────────┤ │haproxy        │ Y    │ Y    │ Integration with │ │               │      │      │ the HAProxy load │ │               │      │      │ balancer         │ ├───────────────┼──────┼──────┼──────────────────┤ │s3front        │ Y    │ Y    │ Integration with │ │               │      │      │ Amazon           │ │               │      │      │ CloudFront       │ │               │      │      │ distribution of  │ │               │      │      │ S3 buckets       │ ├───────────────┼──────┼──────┼──────────────────┤ │gandi          │ Y    │ N    │ Obtain           │ │               │      │      │ certificates via │ │               │      │      │ the Gandi        │ │               │      │      │ LiveDNS API      │ ├───────────────┼──────┼──────┼──────────────────┤ │varnish        │ Y    │ N    │ Obtain           │ │               │      │      │ certificates via │ │               │      │      │ a Varnish server │ └───────────────┴──────┴──────┴──────────────────┘
│external-auth  │ Y    │ Y    │ A plugin for     │ │               │      │      │ convenient       │ │               │      │      │ scripting        │ ├───────────────┼──────┼──────┼──────────────────┤ │pritunl        │ N    │ Y    │ Install          │ │               │      │      │ certificates in  │ │               │      │      │ pritunl          │ │               │      │      │ distributed      │ │               │      │      │ OpenVPN servers  │ ├───────────────┼──────┼──────┼──────────────────┤ │proxmox        │ N    │ Y    │ Install          │ │               │      │      │ certificates in  │ │               │      │      │ Proxmox          │ │               │      │      │ Virtualization   │ │               │      │      │ servers          │ ├───────────────┼──────┼──────┼──────────────────┤ │dns-standalone │ Y    │ N    │ Obtain           │ │               │      │      │ certificates via │ │               │      │      │ an integrated    │ │               │      │      │ DNS server       │ ├───────────────┼──────┼──────┼──────────────────┤ │dns-ispconfig  │ Y    │ N    │ DNS              │ │               │      │      │ Authentication   │ │               │      │      │ using ISPConfig  │ │               │      │      │ as DNS server    │ ├───────────────┼──────┼──────┼──────────────────┤ │dns-clouddns   │ Y    │ N    │ DNS              │ │               │      │      │ Authentication   │ │               │      │      │ using CloudDNS   │ │               │      │      │ API              │ ├───────────────┼──────┼──────┼──────────────────┤ │dns-lightsail  │ Y    │ N    │ DNS              │ │               │      │      │ Authentication   │ │               │      │      │ using Amazon     │ │               │      │      │ Lightsail DNS    │ │               │      │      │ API              │ ├───────────────┼──────┼──────┼──────────────────┤ │dns-inwx       │ Y    │ Y    │ DNS              │ │               │      │      │ Authentication   │ │               │      │      │ for INWX through │ │               │      │      │ the XML API      │ └───────────────┴──────┴──────┴──────────────────┘
If you're interested, you can also write your own plugin.
Managing certificates To view a list of the certificates Certbot knows about, run the certificates subcommand:
certbot certificates
This returns information in the following format:
Found the following certs: Certificate Name: example.com Domains: example.com, www.example.com Expiry Date: 2017-02-19 19:53:00+00:00 (VALID: 30 days) Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem Key Type: RSA Private Key Path: /etc/letsencrypt/live/example.com/privkey.pem
Certificate Name shows the name of the certificate. Pass this name using the --cert-name flag to specify a particular certificate for the run, certonly, certificates, renew, and delete commands. Example:
certbot certonly --cert-name example.com
Re-creating and Updating Existing Certificates You can use certonly or run subcommands to request the creation of a single new certificate even if you already have an existing certificate with some of the same domain names.
If a certificate is requested with run or certonly specifying a certificate name that already exists, Certbot updates the existing certificate. Otherwise a new certificate is created and assigned the specified name.
The --force-renewal, --duplicate, and --expand options control Certbot's behavior when re-creating a certificate with the same name as an existing certificate.  If you don't specify a requested behavior, Certbot may ask you what you intended.
--force-renewal tells Certbot to request a new certificate with the same domains as an existing certificate. Each domain must be explicitly specified via -d. If successful, this certificate is saved alongside the earlier one and symbolic links (the "live" reference) will be updated to point to the new certificate. This is a valid method of renewing a specific individual certificate.
--duplicate tells Certbot to create a separate, unrelated certificate with the same domains as an existing certificate. This certificate is saved completely separately from the prior one. Most users will not need to issue this command in normal circumstances.
--expand tells Certbot to update an existing certificate with a new certificate that contains all of the old domains and one or more additional new domains. With the --expand option, use the -d option to specify all existing domains and one or more new domains.
certbot --expand -d existing.com,example.com,newdomain.com
If you prefer, you can specify the domains individually like this:
certbot --expand -d existing.com -d example.com -d newdomain.com
Consider using --cert-name instead of --expand, as it gives more control over which certificate is modified and it lets you remove domains as well as adding them.
--allow-subset-of-names tells Certbot to continue with certificate generation if only some of the specified domain authorizations can be obtained. This may be useful if some domains specified in a certificate no longer point at this system.
Whenever you obtain a new certificate in any of these ways, the new certificate exists alongside any previously obtained certificates, whether or not the previous certificates have expired. The generation of a new certificate counts against several rate limits that are intended to prevent abuse of the ACME protocol, as described here.
Changing a Certificate's Domains The --cert-name flag can also be used to modify the domains a certificate contains, by specifying new domains using the -d or --domains flag. If certificate example.com previously contained example.com and www.example.com, it can be modified to only contain example.com by specifying only example.com with the -d or --domains flag. Example:
certbot certonly --cert-name example.com -d example.com
The same format can be used to expand the set of domains a certificate contains, or to replace that set entirely:
certbot certonly --cert-name example.com -d example.org,www.example.org
Using ECDSA keys As of version 1.10, Certbot supports two types of private key algorithms: rsa and ecdsa. The type of key used by Certbot can be controlled through the --key-type option. You can also use the --elliptic-curve option to control the curve used in ECDSA certificates.
WARNING: If you obtain certificates using ECDSA keys, you should be careful not to downgrade your Certbot installation since ECDSA keys are not supported by older versions of Certbot. Downgrades like this are possible if you switch from something like the snaps or certbot-auto to packages provided by your operating system which often lag behind.
Changing existing certificates from RSA to ECDSA Unless you are aware that you need to support very old HTTPS clients that are not supported by most sites, you can safely just transition your site to use ECDSA keys instead of RSA keys. To accomplish this if you have existing certificates managed by Certbot, you may freely change the certificate to a new private key.
If you want to use ECDSA keys for all certificates in the future, you can simply add the following line to Certbot's configuration file
key-type = ecdsa
After this option is set, newly obtained certificates will use ECDSA keys. This includes certificates managed by Certbot that previously used RSA keys.
If you want to change a single certificate to use ECDSA keys, you'll need to issue a new Certbot command setting --key-type ecdsa on the command line like
certbot renew --key-type ecdsa --cert-name example.com --force-renewal
Obtaining ECDSA certificates in addition to RSA certificates When Certbot configures the certificates it obtains with Apache or Nginx, all HTTPS clients that we try to support can use certificates with ECDSA keys. If, however, you are aware of having a specific need to support very old TLS clients, you may want to obtain both ECDSA and RSA certificates for the same domains. Certbot can only configure Apache or Nginx to use a single certificate, however, you could manually configure your software to use the different certificates depending on your needs.
When obtaining both ECDSA and RSA certificates for the same domains with Certbot, we recommend using the --cert-name option to give your certificates names so that you can easily identify them. For instance, you may want to append "ecdsa" to the name of your ECDSA certificate by using a command like
certbot certonly --key-type ecdsa --cert-name example.com-ecdsa
Revoking certificates If your account key has been compromised or you otherwise need to revoke a certificate, use the revoke command to do so. Note that the revoke command takes the certificate path (ending in cert.pem), not a certificate name or domain. Example:
certbot revoke --cert-path /etc/letsencrypt/live/CERTNAME/cert.pem
You can also specify the reason for revoking your certificate by using the reason flag.  Reasons include unspecified which is the default, as well as keycompromise, affiliationchanged, superseded, and cessationofoperation:
certbot revoke --cert-path /etc/letsencrypt/live/CERTNAME/cert.pem --reason keycompromise
Additionally, if a certificate is a test certificate obtained via the --staging or --test-cert flag, that flag must be passed to the revoke subcommand.  Once a certificate is revoked (or for other certificate management tasks), all of a certificate's relevant files can be removed from the system with the delete subcommand:
certbot delete --cert-name example.com
NOTE: If you don't use delete to remove the certificate completely, it will be renewed automatically at the next renewal event.
NOTE: Revoking a certificate will have no effect on the rate limit imposed by the Let's Encrypt server.
Renewing certificates NOTE: Let's Encrypt CA issues short-lived certificates (90 days). Make sure you renew the certificates at least once in 3 months.
SEE ALSO: Many of the certbot clients obtained through a distribution come with automatic renewal out of the box, such as Debian and Ubuntu versions installed through apt, CentOS/RHEL 7 through EPEL, etc.  See Automated Renewals for more details.
As of version 0.10.0, Certbot supports a renew action to check all installed certificates for impending expiry and attempt to renew them. The simplest form is simply
certbot renew
This command attempts to renew any previously-obtained certificates that expire in less than 30 days. The same plugin and options that were used at the time the certificate was originally issued will be used for the renewal attempt, unless you specify other plugins or options. Unlike certonly, renew acts on multiple certificates and always takes into account whether each one is near expiry. Because of this, renew is suitable (and designed) for automated use, to allow your system to automatically renew each certificate when appropriate.  Since renew only renews certificates that are near expiry it can be run as frequently as you want - since it will usually take no action.
The renew command includes hooks for running commands or scripts before or after a certificate is renewed. For example, if you have a single certificate obtained using the standalone plugin, you might need to stop the webserver before renewing so standalone can bind to the necessary ports, and then restart it after the plugin is finished. Example:
certbot renew --pre-hook "service nginx stop" --post-hook "service nginx start"
If a hook exits with a non-zero exit code, the error will be printed to stderr but renewal will be attempted anyway. A failing hook doesn't directly cause Certbot to exit with a non-zero exit code, but since Certbot exits with a non-zero exit code when renewals fail, a failed hook causing renewal failures will indirectly result in a non-zero exit code. Hooks will only be run if a certificate is due for renewal, so you can run the above command frequently without unnecessarily stopping your webserver.
When Certbot detects that a certificate is due for renewal, --pre-hook and --post-hook hooks run before and after each attempt to renew it.  If you want your hook to run only after a successful renewal, use --deploy-hook in a command like this.
certbot renew --deploy-hook /path/to/deploy-hook-script
You can also specify hooks by placing files in subdirectories of Certbot's configuration directory. Assuming your configuration directory is /etc/letsencrypt, any executable files found in /etc/letsencrypt/renewal-hooks/pre, /etc/letsencrypt/renewal-hooks/deploy, and /etc/letsencrypt/renewal-hooks/post will be run as pre, deploy, and post hooks respectively when any certificate is renewed with the renew subcommand. These hooks are run in alphabetical order and are not run for other subcommands. (The order the hooks are run is determined by the byte value of the characters in their filenames and is not dependent on your locale.)
Hooks specified in the command line, configuration file, or renewal configuration files are run as usual after running all hooks in these directories. One minor exception to this is if a hook specified elsewhere is simply the path to an executable file in the hook directory of the same type (e.g. your pre-hook is the path to an executable in /etc/letsencrypt/renewal-hooks/pre), the file is not run a second time. You can stop Certbot from automatically running executables found in these directories by including --no-directory-hooks on the command line.
More information about hooks can be found by running certbot --help renew.
If you're sure that this command executes successfully without human intervention, you can add the command to crontab (since certificates are only renewed when they're determined to be near expiry, the command can run on a regular basis, like every week or every day). In that case, you are likely to want to use the -q or --quiet quiet flag to silence all output except errors.
If you are manually renewing all of your certificates, the --force-renewal flag may be helpful; it causes the expiration time of the certificate(s) to be ignored when considering renewal, and attempts to renew each and every installed certificate regardless of its age. (This form is not appropriate to run daily because each certificate will be renewed every day, which will quickly run into the certificate authority rate limit.)
Note that options provided to certbot renew will apply to every certificate for which renewal is attempted; for example, certbot renew --rsa-key-size 4096 would try to replace every near-expiry certificate with an equivalent certificate using a 4096-bit RSA public key. If a certificate is successfully renewed using specified options, those options will be saved and used for future renewals of that certificate.
An alternative form that provides for more fine-grained control over the renewal process (while renewing specified certificates one at a time), is certbot certonly with the complete set of subject domains of a specific certificate specified via -d flags. You may also want to include the -n or --noninteractive flag to prevent blocking on user input (which is useful when running the command from cron).
certbot certonly -n -d example.com -d www.example.com
All of the domains covered by the certificate must be specified in this case in order to renew and replace the old certificate rather than obtaining a new one; don't forget any www. domains! Specifying a subset of the domains creates a new, separate certificate containing only those domains, rather than replacing the original certificate.  When run with a set of domains corresponding to an existing certificate, the certonly command attempts to renew that specific certificate.
Please note that the CA will send notification emails to the address you provide if you do not renew certificates that are about to expire.
Certbot is working hard to improve the renewal process, and we apologize for any inconvenience you encounter in integrating these commands into your individual environment.
NOTE: certbot renew exit status will only be 1 if a renewal attempt failed. This means certbot renew exit status will be 0 if no certificate needs to be updated.  If you write a custom script and expect to run a command only after a certificate was actually renewed you will need to use the --deploy-hook since the exit status will be 0 both on successful renewal and when renewal is not necessary.
Modifying the Renewal Configuration File When a certificate is issued, by default Certbot creates a renewal configuration file that tracks the options that were selected when Certbot was run. This allows Certbot to use those same options again when it comes time for renewal. These renewal configuration files are located at /etc/letsencrypt/renewal/CERTNAME.
For advanced certificate management tasks, it is possible to manually modify the certificate's renewal configuration file, but this is discouraged since it can easily break Certbot's ability to renew your certificates. If you choose to modify the renewal configuration file we advise you to test its validity with the certbot renew --dry-run command.
WARNING: Modifying any files in /etc/letsencrypt can damage them so Certbot can no longer properly manage its certificates, and we do not recommend doing so.
For most tasks, it is safest to limit yourself to pointing symlinks at the files there, or using --deploy-hook to copy / make new files based upon those files, if your operational situation requires it (for instance, combining certificates and keys in different way, or having copies of things with different specific permissions that are demanded by other programs).
If the contents of /etc/letsencrypt/archive/CERTNAME are moved to a new folder, first specify the new folder's name in the renewal configuration file, then run certbot update_symlinks to point the symlinks in /etc/letsencrypt/live/CERTNAME to the new folder.
If you would like the live certificate files whose symlink location Certbot updates on each run to reside in a different location, first move them to that location, then specify the full path of each of the four files in the renewal configuration file. Since the symlinks are relative links, you must follow this with an invocation of certbot update_symlinks.
For example, say that a certificate's renewal configuration file previously contained the following directives:
archive_dir = /etc/letsencrypt/archive/example.com cert = /etc/letsencrypt/live/example.com/cert.pem privkey = /etc/letsencrypt/live/example.com/privkey.pem chain = /etc/letsencrypt/live/example.com/chain.pem fullchain = /etc/letsencrypt/live/example.com/fullchain.pem
The following commands could be used to specify where these files are located:
mv /etc/letsencrypt/archive/example.com /home/user/me/certbot/example_archive sed -i 's,/etc/letsencrypt/archive/example.com,/home/user/me/certbot/example_archive,' /etc/letsencrypt/renewal/example.com.conf mv /etc/letsencrypt/live/example.com/*.pem /home/user/me/certbot/ sed -i 's,/etc/letsencrypt/live/example.com,/home/user/me/certbot,g' /etc/letsencrypt/renewal/example.com.conf certbot update_symlinks
Automated Renewals Many Linux distributions provide automated renewal when you use the packages installed through their system package manager.  The following table is an incomplete list of distributions which do so, as well as their methods for doing so.
If you are not sure whether or not your system has this already automated, refer to your distribution's documentation, or check your system's crontab (typically in /etc/crontab/ and /etc/cron.*/* and systemd timers (systemctl list-timers).
Distributions with Automated Renewal ┌──────────────────┬──────────────────────┬───────────────────┐ │Distribution Name │ Distribution Version │ Automation Method │ ├──────────────────┼──────────────────────┼───────────────────┤ │CentOS            │ EPEL 7               │ systemd           │ ├──────────────────┼──────────────────────┼───────────────────┤ │Debian            │ stretch              │ cron, systemd     │ ├──────────────────┼──────────────────────┼───────────────────┤ │Debian            │ testing/sid          │ cron, systemd     │ ├──────────────────┼──────────────────────┼───────────────────┤ │Fedora            │ 26                   │ systemd           │ ├──────────────────┼──────────────────────┼───────────────────┤ │Fedora            │ 27                   │ systemd           │ ├──────────────────┼──────────────────────┼───────────────────┤ │RHEL              │ EPEL 7               │ systemd           │ ├──────────────────┼──────────────────────┼───────────────────┤ │Ubuntu            │ 17.10                │ cron, systemd     │ ├──────────────────┼──────────────────────┼───────────────────┤ │Ubuntu            │ certbot PPA          │ cron, systemd     │ └──────────────────┴──────────────────────┴───────────────────┘
Where are my certificates? All generated keys and issued certificates can be found in /etc/letsencrypt/live/$domain. In the case of creating a SAN certificate with multiple alternative names, $domain is the first domain passed in via -d parameter. Rather than copying, please point your (web) server configuration directly to those files (or create symlinks). During the renewal, /etc/letsencrypt/live is updated with the latest necessary files.
For historical reasons, the containing directories are created with permissions of 0700 meaning that certificates are accessible only to servers that run as the root user.  If you will never downgrade to an older version of Certbot, then you can safely fix this using chmod 0755 /etc/letsencrypt/{live,archive}.
For servers that drop root privileges before attempting to read the private key file, you will also need to use chgrp and chmod 0640 to allow the server to read /etc/letsencrypt/live/$domain/privkey.pem.
NOTE: /etc/letsencrypt/archive and /etc/letsencrypt/keys contain all previous keys and certificates, while /etc/letsencrypt/live symlinks to the latest versions.
The following files are available:
privkey.pem Private key for the certificate.
WARNING: This must be kept secret at all times! Never share it with anyone, including Certbot developers. You cannot put it into a safe, however - your server still needs to access this file in order for SSL/TLS to work.
NOTE: As of Certbot version 0.29.0, private keys for new certificate default to 0600. Any changes to the group mode or group owner (gid) of this file will be preserved on renewals.
This is what Apache needs for SSLCertificateKeyFile, and Nginx for ssl_certificate_key.
fullchain.pem All certificates, including server certificate (aka leaf certificate or end-entity certificate). The server certificate is the first one in this file, followed by any intermediates.
This is what Apache >= 2.4.8 needs for SSLCertificateFile, and what Nginx needs for ssl_certificate.
cert.pem and chain.pem (less common) cert.pem contains the server certificate by itself, and chain.pem contains the additional intermediate certificate or certificates that web browsers will need in order to validate the server certificate. If you provide one of these files to your web server, you must provide both of them, or some browsers will show "This Connection is Untrusted" errors for your site, some of the time.
Apache < 2.4.8 needs these for SSLCertificateFile.  and SSLCertificateChainFile, respectively.
If you're using OCSP stapling with Nginx >= 1.3.7, chain.pem should be provided as the ssl_trusted_certificate to validate OCSP responses.
NOTE: All files are PEM-encoded.  If you need other format, such as DER or PFX, then you could convert using openssl. You can automate that with --deploy-hook if you're using automatic renewal.
Pre and Post Validation Hooks Certbot allows for the specification of pre and post validation hooks when run in manual mode. The flags to specify these scripts are --manual-auth-hook and --manual-cleanup-hook respectively and can be used as follows:
certbot certonly --manual --manual-auth-hook /path/to/http/authenticator.sh --manual-cleanup-hook /path/to/http/cleanup.sh -d secure.example.com
This will run the authenticator.sh script, attempt the validation, and then run the cleanup.sh script. Additionally certbot will pass relevant environment variables to these scripts:
• CERTBOT_DOMAIN: The domain being authenticated
• CERTBOT_VALIDATION: The validation string
• CERTBOT_TOKEN: Resource name part of the HTTP-01 challenge (HTTP-01 only)
• CERTBOT_REMAINING_CHALLENGES: Number of challenges remaining after the current challenge
• CERTBOT_ALL_DOMAINS: A comma-separated list of all domains challenged for the current certificate
Additionally for cleanup:
• CERTBOT_AUTH_OUTPUT: Whatever the auth script wrote to stdout
Example usage for HTTP-01:
certbot certonly --manual --preferred-challenges=http --manual-auth-hook /path/to/http/authenticator.sh --manual-cleanup-hook /path/to/http/cleanup.sh -d secure.example.com
/path/to/http/authenticator.sh
#!/bin/bash echo $CERTBOT_VALIDATION > /var/www/htdocs/.well-known/acme-challenge/$CERTBOT_TOKEN
/path/to/http/cleanup.sh
#!/bin/bash rm -f /var/www/htdocs/.well-known/acme-challenge/$CERTBOT_TOKEN