|
Automate Let's Encrypt SSL Certificate Renewal with Python Certbot Dec 19, 2025 Development Environment

Automate Let's Encrypt SSL Certificate Renewal with Python Certbot

In today’s cybersecurity landscape, enabling HTTPS on a website has become a fundamental requirement. Major browsers prominently warn users about sites without SSL, and SSL certificate validity from cloud providers and free CAs has been further reduced to just 30 days. If operations staff forget to renew certificates on time, HTTPS breaks easily — leading to service outages.

To address this, Let’s Encrypt provides a fully automated, free certificate issuance service, and Certbot is its officially recommended certificate management tool. This article walks through installing Certbot via Python (pip) to automate SSL certificate provisioning and renewal, eliminating the operational risk of certificate expiration.

1. Environment Prerequisites

The example environment used in this article:

  • OS: Linux (Debian / Ubuntu)

  • Python version: Python 3

  • Web server: Nginx or Apache

  • Domain: correctly resolved to the server’s public IP

2. Install Python and pip

If Python 3 is not yet installed, run the following:

sudo apt update
sudo apt install python3 python3-pip -y

Verify the installation:

python3 --version
pip3 --version

3. Install Certbot via pip

Install the latest Certbot using Python’s pip:

sudo pip3 install certbot

Install the Web Server Plugin

Choose the plugin matching your web server:

For Nginx:

sudo pip3 install certbot-nginx

For Apache:

sudo pip3 install certbot-apache

After installation, verify Certbot is working:

certbot --version

If the command is not found, use the full path:

/usr/local/bin/certbot --version

4. Request a Let’s Encrypt SSL Certificate

Nginx Example

sudo certbot --nginx

Apache Example

sudo certbot --apache

Certbot will automatically:

  • Verify domain ownership

  • Request and install the SSL certificate

  • Update the web server configuration

  • Enable HTTPS (with optional automatic redirect)

Certificates are stored by default at:

/etc/letsencrypt/live/yourdomain/

5. Configure Automatic Certificate Renewal (Key Step)

Since Let’s Encrypt certificates are valid for only 30 days, an automated renewal mechanism is mandatory. Certbot installed via pip does not automatically create a system cron job, so you need to configure cron manually.

1. Confirm the certbot Executable Path

which certbot

Typically returns:

/usr/local/bin/certbot

2. Create a Cron Job

Edit root’s crontab:

sudo crontab -e

Add the following line at the end of the file:

0 12 * * * /usr/local/bin/certbot renew --quiet

What this does:

  • Runs a certificate status check every day at noon

  • Automatically renews certificates when they are close to expiring

  • The --quiet flag suppresses non-essential output, logging only on errors

6. Verify the Automatic Renewal Setup

Before going live, validate the renewal flow with a dry run:

sudo certbot renew --dry-run

If you see the following message, the renewal mechanism is configured correctly:

Congratulations, all simulated renewals succeeded

7. Additional Notes

  1. Certbot installed via pip is not automatically upgraded by the system package manager. Periodically run sudo pip3 install --upgrade certbot to stay on the latest version.

  2. If Certbot is deployed inside a virtual environment, make sure the cron job invokes the certbot executable from that virtual environment — otherwise renewal may fail due to missing plugin dependencies.

Conclusion

With SSL certificate validity now reduced to 30 days, manual renewal is no longer practical. With Python + Certbot + Let’s Encrypt, certificate management can be fully automated — fundamentally eliminating the risk of service outages caused by certificate expiration.

Deploy once, benefit forever. Let HTTPS become truly “maintenance-free” infrastructure.