Certbot - Revision history

Nick: /* Using The Standalone Mode */

2026-03-26T03:24:35Z

Using The Standalone Mode

Nick: /* Prerequisites */

2026-03-26T03:23:51Z

Prerequisites

Nick at 09:45, 25 March 2026

2026-03-25T09:45:50Z

Nick: /* Using The Standalone Mode */

2026-03-25T02:09:03Z

Using The Standalone Mode

Nick at 02:07, 25 March 2026

2026-03-25T02:07:53Z

Nick at 01:38, 25 March 2026

2026-03-25T01:38:53Z

Nick: Reorganized and fleshed out existing information

2026-03-25T01:16:56Z

Reorganized and fleshed out existing information

Nick at 01:02, 25 March 2026

2026-03-25T01:02:14Z

Nick: Added plaintext boxes for code snippets

2026-03-25T00:35:03Z

Added plaintext boxes for code snippets

Nick: Initial commit / Information dump from labwork

2026-03-24T10:54:58Z

Initial commit / Information dump from labwork

New page

This is placeholder text for future editing.

Add the EPEL repo:
sudo dnf install epel-release

Install Certbot:
sudo dnf install cerbot

#Verify installation
certbot -v

Obtaining a certificate:
#Apache plugin
sudo certbot --apache

#Nginx plugin
sudo certbot --nginx

#Standalone mode
sudo certbot certonly --standalone -d domainname.com -d www.domainname.com

Certbot Timer File Location:
/etc/systemd/system/certbot-renewal.timer

Certbot Timer File Contents:

[Unit]
Description=Run Certbot renewal periodically
Documentation=https://certbot.eff.org/docs/using.html#renewal

[Timer]
# Run daily at midnight
OnCalendar=*-*-* 00:00:00
# Also run 12 hours later
OnCalendar=*-*-* 12:00:00
# Randomize start time slightly to prevent thundering herd
RandomizedDelaySec=3600
# Persist across reboots
Persistent=true

[Install]
WantedBy=timers.target

Certbot Service File Location:
/etc/systemd/system/certbot-renewal.service

Certbot Service File Contents:
[Unit]
Description=Certbot Certificate Renewal
Documentation=https://certbot.eff.org/docs/using.html#renewal

[Service]
Type=oneshot
ExecStart=/usr/bin/certbot renew --quiet
User=root
Group=root

Enabling and Starting The Timer
# Reload systemd to recognize new units
sudo systemctl daemon-reload

# Enable the timer (starts on boot)
sudo systemctl enable certbot-renewal.timer

# Start the timer immediately
sudo systemctl start certbot-renewal.timer

# Verify it's active
sudo systemctl status certbot-renewal.timer

Verifying The Timer:
# List all active timers
sudo systemctl list-timers

# Check specific timer details
systemctl list-timers --all | grep certbot

# View next scheduled run
systemctl list-timers | grep certbot

Testing The Service File Manually:
# Trigger a dry-run renewal
sudo systemctl start certbot-renewal.service

# Check if it executed successfully
sudo systemctl status certbot-renewal.service

Special Note:
If the server the certificates are for is located "behind" a reverse-proxy server, install and run Certbot and the certificates on the reverse-proxy server instead of locally on the intended server. Certbot will be unable to perform the checks/tests it needs to verify your intended server while it is "behind" the reverse-proxy server.

Be sure to update the file located at:
/etc/nginx/conf.d/reverse-proxy.conf

To include the below:
server {
listen 443 ssl http2; #This is required or it will not function
server_name domainname.com;

ssl_certificate /etc/letsencrypt/live/domainname.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/domainname.com/privkey.pem;
}

And if HTTP > HTTPS redirecting is desired:
server {
listen 80;
server_name domainname.com;
return 301 https://$server_name$request_uri;
}

@@ Line 47: / Line 47: @@
 === Using The Standalone Mode ===
-'''Note: While the standalone mode is web-server agnostic, it will require that the web-server service be deactivated''' so that port 80 is available for certbot to use. Instructions to do so are below if needed, if not, proceed to the next step [https://nlear.xyz/wiki/index.php/Certbot#Obtaining_Certificates_Via_Certbot_Standalone_Mode here.]
+'''Note: While the standalone mode is web-server agnostic, it will require that the web-server service be deactivated''' so that port 80 is available for certbot to use. Instructions to do so are below if needed, if not, proceed to the next step [[Certbot#Obtaining_Certificates_Via_Certbot_Standalone_Mode|here.]]
 ==== Stopping Web Services ====

@@ Line 8: / Line 8: @@
 First, you may not even require Certbot on your machine. Many web hosting providers provide internal tools to enable HTTPS on the sites that they're hosting. You should check with your provider or use [https://certbot.eff.org/hosting_providers this tool] provided by Certbot and the EFF to see if your hosting provider is one of those providers.
-Second, if your web hosting provider is not listed in the above tool, you will need a web server of some kind (Apache, Nginx, etc) already up and running that is accessible on Port 80 on the internet in order to follow along with the below instructions. A Wiki page to help achieve this can be found [https://nlear.xyz/wiki/index.php/Installing_The_LAMP_Stack_On_A_Server here] if needed.
+Second, if your web hosting provider is not listed in the above tool, you will need a web server of some kind (Apache, Nginx, etc) already up and running that is accessible on Port 80 on the internet in order to follow along with the below instructions. A Wiki page to help achieve this can be found [[Installing_The_LAMP_Stack_On_A_Server|here]] if needed.
 Third, this Wiki is written for installing certificates via Certbot on a CentOS/RHEL system. All of this information is still applicable to other Linux distributions, but the commands, syntax, and file locations '''may be different'''. Be sure to consult the official Certbot documentation [https://certbot.eff.org/instructions here] for any changes specific to your distribution.
 == Installing Certbot ==

@@ Line 17: / Line 17: @@
 Add the EPEL (Extra Packagaes for Enterprise Linux) repo to your system:
   <nowiki>sudo dnf install epel-release</nowiki>
 Install Certbot:

@@ Line 49: / Line 49: @@
 === Using The Standalone Mode ===
-'''Note: While the standalone mode is web-server agnostic, it will require that the web-server service be deactivated''' so that port 80 is available for certbot to use. Instructions to do so are below if needed, if not, proceed to the next step [https://nlear.xyz/wiki/index.php?title=Certbot&action=submit#Obtaining_Certificates_Via_Certbot_Standalone_Mode here.]
+'''Note: While the standalone mode is web-server agnostic, it will require that the web-server service be deactivated''' so that port 80 is available for certbot to use. Instructions to do so are below if needed, if not, proceed to the next step [https://nlear.xyz/wiki/index.php/Certbot#Obtaining_Certificates_Via_Certbot_Standalone_Mode here.]
 ==== Stopping Web Services ====
@@ Line 80: / Line 80: @@
 Or if you have both "example.com" and "foobar.com", provide all of the following: "example.com", "www.example.com", "foobar.com", and "www.foobar.com" with their own respective "-d" flags.
   <nowiki>sudo certbot certonly --standalone -d example.com -d www.example.com -d foobar.com -d www.foobar.com</nowiki>
 == Automating Certificate Renewal Using Systemd ==

@@ Line 1: / Line 1: @@
 == Prerequisites ==
 You will need a web server of some kind (Apache, Nginx, etc) already up and running that is accessible on Port 80 on the internet in order to follow along with the below instructions. A Wiki page to help achieve this can be found [https://nlear.xyz/wiki/index.php/Installing_The_LAMP_Stack_On_A_Server here] if needed.
 == Installing Certbot ==
-Add the EPEL repo:
+Add the EPEL (Extra Packagaes for Enterprise Linux) repo to your system:
   <nowiki>sudo dnf install epel-release</nowiki>
@@ Line 12: / Line 22: @@
   <nowiki>sudo dnf install cerbot</nowiki>
-Verify Certbot is installed:
+Verify Certbot is installed and confirm the version number meets any dependencies you might have:
   <nowiki>certbot -v</nowiki>
@@ Line 22: / Line 32: @@
   <nowiki>sudo certbot --apache</nowiki>
@@ Line 27: / Line 41: @@
   <nowiki>sudo certbot --nginx</nowiki>
 === Using The Standalone Mode ===
 '''Note: While the standalone mode is web-server agnostic, it will require that the web-server service be deactivated''' so that port 80 is available for certbot to use. Instructions to do so are below if needed, if not, proceed to the next step [https://nlear.xyz/wiki/index.php?title=Certbot&action=submit#Obtaining_Certificates_Via_Certbot_Standalone_Mode here.]
 ==== Stopping Web Services ====
 To deactivate the Apache service:
   <nowiki>sudo systemctl stop httpd.service</nowiki>
@@ Line 39: / Line 59: @@
 ==== Obtaining Certificates Via Certbot Standalone Mode ====
 '''If your web-server service is still running at this point, please see above!'''
@@ Line 175: / Line 196: @@
      return 301 https://$server_name$request_uri;
 }</nowiki>

@@ Line 1: / Line 1: @@
 == Prerequisites ==
 == Installing Certbot ==
@@ Line 12: / Line 14: @@
 Verify Certbot is installed:
   <nowiki>certbot -v</nowiki>
 == Obtaining a Certificate using Certbot ==
 === Using The Apache Plugin ===
   <nowiki>sudo certbot --apache</nowiki>
 === Using The Nginx Plugin ===
   <nowiki>sudo certbot --nginx</nowiki>
 === Using The Standalone Mode ===
-Note: While the standalone mode is web-server agnostic, it will require that the web-server service be deactivated so that port 80 is available for certbot to use.
+'''Note: While the standalone mode is web-server agnostic, it will require that the web-server service be deactivated''' so that port 80 is available for certbot to use. Instructions to do so are below if needed, if not, proceed to the next step [https://nlear.xyz/wiki/index.php?title=Certbot&action=submit#Obtaining_Certificates_Via_Certbot_Standalone_Mode here.]
   <nowiki>sudo certbot certonly --standalone -d domainname.com -d www.domainname.com</nowiki>
@@ Line 36: / Line 67: @@
 If additional information is needed/wanted about Systemd timers and service files, the Arch Wiki has a good reference  [https://wiki.archlinux.org/title/Systemd/Timers here.]
 === Certbot Systemd Timer File ===
@@ Line 77: / Line 109: @@
 === Enabling And Starting The Certbot Systemd Timer File ===
 ==== Reload Systemd ====
 Reload systemd to recognize the new unit files that were created:
@@ Line 102: / Line 136: @@
 ==== Perform a Test Run ====
 To trigger a manual run of the Certbot renewal service:
@@ Line 113: / Line 147: @@
   <nowiki>sudo systemctl status certbot-renewal.service</nowiki>
 Again, if the service was executed successfully, there should not be any errors or serious warnings included in the brief logs output by the above command.
@@ Line 122: / Line 154: @@
 If the server(s) the certificates are for are located "behind" a reverse-proxy server, install and run Certbot (and the certificates) on the reverse-proxy server instead of locally on the intended server(s). '''Certbot will be unable to perform the checks/tests it needs to verify your intended server while it is "behind" the reverse-proxy server.
 '''
 ==== After Certificates Are Installed on Reverse-Proxy ====
 Be sure to update the reverse proxy config file likely located at:

@@ Line 76: / Line 76: @@
-=== Enabling and Starting The Certbot Systemd Timer File ===
+=== Enabling And Starting The Certbot Systemd Timer File ===
 Reload systemd to recognize the new unit files that were created:
   <nowiki>sudo systemctl daemon-reload</nowiki>
 Enable the timer file so that it is started on every boot:
   <nowiki>sudo systemctl enable certbot-renewal.timer</nowiki>
@@ Line 86: / Line 88: @@
   <nowiki>sudo systemctl start certbot-renewal.timer</nowiki>
 Verify that the timer is started (active) and enabled:
   <nowiki>sudo systemctl status certbot-renewal.timer</nowiki>
+Alternatively, list all active timers:
   <nowiki>sudo systemctl list-timers</nowiki>
-# Check specific timer details
+Or check a specific timer's details:
   <nowiki>systemctl list-timers --all | grep certbot</nowiki>
-# View next scheduled run
+Or to view the next scheduled run for a particular timer:
   <nowiki>systemctl list-timers | grep certbot</nowiki>
-Testing The Service File Manually:
+=== Testing The Service File Manually ===
-# Trigger a dry-run renewal
+==== Perform a Test Run ====
   <nowiki>sudo systemctl start certbot-renewal.service</nowiki>
-# Check if it executed successfully
+==== Review The Test Run ====
   <nowiki>sudo systemctl status certbot-renewal.service</nowiki>
-Special Note:
+== Special Considerations ==
-Be sure to update the file located at:
+=== Reverse-Proxy Setup ===
   <nowiki>/etc/nginx/conf.d/reverse-proxy.conf</nowiki>
@@ Line 126: / Line 134: @@
      ssl_certificate_key /etc/letsencrypt/live/domainname.com/privkey.pem;
 }</nowiki>
-And if HTTP > HTTPS redirecting is desired, include the below as well in the same file:
+If HTTP > HTTPS redirecting is desired, so that HTTP requests are redirected as HTTPS requests, include the below as well in the same reverse proxy config file:
   <nowiki>server {
      listen 80;

@@ Line 1: / Line 1: @@
-This is placeholder text for future editing.
+== Prerequisites ==
 Add the EPEL repo:
@@ Line 8: / Line 10: @@
   <nowiki>sudo dnf install cerbot</nowiki>
-#Verify installation
+Verify Certbot is installed:
   <nowiki>certbot -v</nowiki>
   <nowiki>sudo certbot --apache</nowiki>
-#Nginx plugin
+=== Using The Nginx Plugin ===
   <nowiki>sudo certbot --nginx</nowiki>
-#Standalone mode
+=== Using The Standalone Mode ===
   <nowiki>sudo certbot certonly --standalone -d domainname.com -d www.domainname.com</nowiki>
@@ Line 25: / Line 30: @@
-Certbot Timer File Location:
+To automate this renewal process, if Certbot's own renewal timers were not installed for some reason, Systemd timer and service files can be created to manually renew the certificates using Cerbot on an automated schedule.
   <nowiki>/etc/systemd/system/certbot-renewal.timer</nowiki>
-Certbot Timer File Contents:
+And it should contain the following:
   <nowiki>[Unit]
 Description=Run Certbot renewal periodically
@@ Line 49: / Line 60: @@
+=== Certbot Systemd Service File ===
+The Systemd service file should be created here:
   <nowiki>/etc/systemd/system/certbot-renewal.service
-Certbot Service File Contents:
+And the service file should contain the following:
   <nowiki>[Unit]
 Description=Certbot Certificate Renewal
@@ Line 66: / Line 76: @@
+=== Enabling and Starting The Certbot Systemd Timer File ===
-Enabling and Starting The Timer
+Reload systemd to recognize the new unit files that were created:
   <nowiki>sudo systemctl daemon-reload</nowiki>
-# Enable the timer (starts on boot)
+Enable the timer file so that it is started on every boot:
   <nowiki>sudo systemctl enable certbot-renewal.timer</nowiki>
-# Start the timer immediately
+Start the timer manually if it is not already started:
   <nowiki>sudo systemctl start certbot-renewal.timer</nowiki>
-# Verify it's active
+Verify that the timer is started (active) and enabled:
   <nowiki>sudo systemctl status certbot-renewal.timer</nowiki>