---
title: certbot — certificate issuance and renewal
date: 2026-10-18
time: 12:00
model: admin
category: programs
author_type: human
summary: A tool that issues and renews Let's Encrypt certificates and manages auto-renewal status.
tags: program, Web server operations, certbot
---

**💬 "certbot command"**

certbot **issues and renews free certificates**. In practice, checking the state of renewal automation is essential.

Use renew --dry-run to verify in advance whether renewal will actually succeed.

- **Concept**: Issues and renews certificates using the ACME protocol.
- **renew**: Renews certificates nearing expiration.
- **timer**: Automatic renewal runs through a systemd timer.
- **dry-run**: Tests whether renewal can succeed without actually performing it.
## Commonly used options

| Option | Description |
| --- | --- |
| renew | Renew certificates nearing expiration |
| --dry-run | Test renewal without actual issuance |
| certificates | List managed certificates and expiration dates |
| --nginx / --webroot | Specify validation method (plugin) |

## 3 essential command combinations

- `certbot certificates` — Check the certificate list and expiration dates
- `certbot renew --dry-run` — Verify that automatic renewal succeeds
- `systemctl list-timers | grep certbot` — Check the automatic renewal timer
**💬 "Show me an example of connecting this to alert automation"**

Here are the situations commonly encountered on live production servers, organized in order.

### Step 1 · Certificate status

Check expiration dates and target domains.

```
certbot certificates
```

### Step 2 · Renewal test

Verify that renewal can succeed before actually renewing.

```
certbot renew --dry-run
```

### Step 3 · Timer check

Check whether automatic renewal is scheduled.

```
systemctl list-timers certbot.timer --no-pager
```

## How this is used in practice

### 1. Guarding against automatic renewal failure

**Situation** — Renewals can fail silently and put you at risk of expiration.

```
certbot renew --dry-run
```

**Result** — If verification fails, the cause (webroot path, firewall, DNS) is printed.

**Key point** — Add a dry-run check to your monthly routine.

### 2. Checking the certificate list

**Situation** — You need to see expiration dates for multiple domain certificates at once.

```
certbot certificates | grep -E 'Certificate Name|Expiry'
```

**Result** — Names and expiration dates are printed together, so you can spot at-risk certificates.

**Key point** — For certificates expiring within 30 days, also check the renewal logs.

## Things to watch out for

- Even dry-run requests hit Let's Encrypt servers, so excessive repetition can be rate-limited.
- Webroot validation succeeds only if the domain is actually reachable.
- Forcefully reissuing certificates may hit the weekly issuance limit.
## Actual execution screen

This is the result of checking certificate expiration dates and the likelihood of automatic renewal success.

![certbot command execution result: certificate list and renewal test](https://games.aidebatehub.com/assets/certbot-demo.png)

A production server in active use

---
Source (HTML): https://games.aidebatehub.com/programs/linux/webserver/certbot.html
This file is an auto-generated Markdown twin of the DevHub document.