CODEWITHSUNDEEP
lets-encryptmanual-testingcertbot
Philipp Claßen
Philipp Claßen

Reputation: 43969

Let's Encrypt: How to manually test the certbot renewal process?

I have a working setup where Let's Encrypt certificates are generated with certbot. I wonder how you effectively test whether the renewal will work in production.

The certificates last for 90 days. Is there a way to reduce the lifespan to, for instance, 10 minutes, to see if the renewal works? (Using the staging system for that is fine.)

If you have an alternative approach how to make sure that your renewal code works (without having to wait for 90 days), it would also be appreciated.

Upvotes: 19

Views: 32113

Answers (4)

Steve Wall
Steve Wall

Reputation: 1932

If this is to test the renewal process, it is worth noting using the --test-cert flag uses a different letencrypt server and will not be counted against your limit. Of course, the generated certs are invalid. But it will test the renewal process.

--test-cert, --staging
                    Use the Let's Encrypt staging server to obtain or
                    revoke test (invalid) certificates; equivalent to
                    --server https://acme-
                    staging-v02.api.letsencrypt.org/directory (default:
                    False)

Upvotes: 0

Diggy.
Diggy.

Reputation: 6944

It's worth noting that renew doesn't like working in conjunction with domain-specific renewals, as per (certbot v1.22.0):

Currently, the renew verb is capable of either renewing all installed certificates that are due to be renewed or renewing a single certificate specified by its name. If you would like to renew specific certificates by their domains, use the certonly command instead. The renew verb may provide other options for selecting certificates to renew in the future.

Taking this into account, you might want to consider using the following command:
certbot certonly --dry-run -d my.domain.com

References:

Upvotes: 2

Greg Schmit
Greg Schmit

Reputation: 4574

You use the --dry-run option. E.g.:

$ sudo certbot renew --dry-run

From certbot -h:

certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

...

--dry-run Test "renew" or "certonly" without saving any certificates to disk

This ensures that the certbot can validate your domain with your current configuration.

If you really want to save the certificates to disk and see if your system is using the new cert, then you can also use the --force-renewal option. In that case, you should visit your website and check that the active certificate is the new one. If it isn't, you likely need to adjust your cronjob to restart your web server. E.g.:

certbot renew && service apache24 restart

Upvotes: 27

Djaevel
Djaevel

Reputation: 192

You can use "certbot renew --force-renewal"

https://certbot.eff.org/docs/using.html#configuration-file

--force-renewal, --renew-by-default

If a certificate already exists for the requested domains, renew it now, regardless of whether it is near expiry. (Often --keep-until-expiring is more appropriate). Also implies --expand. (default: False)

Upvotes: 6

Related Questions