How to Manage Let’s Encrypt SSL Certificates with Certbot Commands

SSL certificates keep your website safe. They protect the data your visitors send and receive. Without SSL, browsers show a “Not Secure” warning, which pushes visitors away.

Let’s Encrypt gives you free SSL certificates. Certbot is the tool you use to get, renew, and manage those certificates. In this guide, you will learn all the important Certbot commands you need to manage your SSL certificates the right way.

What is Certbot?

Certbot is a free, open-source tool made by the Electronic Frontier Foundation (EFF). It talks directly to Let’s Encrypt and handles everything – from getting your certificate to renewing it automatically.

You do not need to pay anything. You do not need to fill out forms. In most cases, a single command can issue and install a valid SSL certificate within minutes.

How to Install Certbot

Before you run any commands, you need to install Certbot on your server.

On Ubuntu / Debian:

sudo apt update
sudo apt install snapd -y
sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot

If you use Nginx:

sudo snap install certbot-nginx

If you use Apache:

sudo snap install certbot-apache

How to Get a New SSL Certificate

For Nginx

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

For Apache

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Standalone Mode (No Web Server)

Use this when no web server is running on port 80:

sudo certbot certonly --standalone -d yourdomain.com

Webroot Mode

Use this when your web server is already running and you do not want to stop it:

sudo certbot certonly --webroot -w /var/www/html -d yourdomain.com -d www.yourdomain.com

Certbot will verify your domain and create the certificate files. You will find them inside /etc/letsencrypt/live/yourdomain.com/.

Certificate File Locations

After getting your certificate, Certbot saves four files:

• cert.pem – Your domain certificate
• privkey.pem – Your private key
• chain.pem – The certificate chain
• fullchain.pem – cert.pem + chain.pem combined

Most web servers need fullchain.pem and privkey.pem.

How to List All SSL Certificates

To see all the certificates Certbot manages on your server:

sudo certbot certificates

This shows you the domain name, expiry date, and file path for each certificate. It is a quick way to check which certificates are active.

How to Renew SSL Certificates

Let’s Encrypt certificates last for 90 days. You need to renew them before they expire.

Renew All Certificates

sudo certbot renew

This command checks all your certificates. It only renews the ones that are close to expiring (within 30 days).

Force Renew a Certificate

If you want to renew right now, even if it is not close to expiring:

sudo certbot renew --force-renewal

Renew a Specific Domain

sudo certbot renew --cert-name yourdomain.com

Test the Renewal Process (Dry Run)

Before running the real renewal, you can test it without making any changes:

sudo certbot renew --dry-run

This is strongly recommended in production environments. It tells you if renewal will work before the real deadline arrives.

How to Set Up Automatic Renewal

Certbot sets up a cron job or systemd timer automatically during installation. You can check if it is active:

sudo systemctl list-timers | grep certbot

You can also add your own cron job to be safe. Open the cron editor:

sudo crontab -e

Add this line to renew certificates twice a day:

0 0,12 * * * certbot renew --quiet

How to Add a New Domain to an Existing Certificate

If you want to add another domain to a certificate you already have:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com -d blog.yourdomain.com

Certbot will update the existing certificate to include the new domain.

How to Delete an SSL Certificate

If you no longer need a certificate, you can remove it:

sudo certbot delete --cert-name yourdomain.com

Certbot will ask you to confirm. After deletion, the certificate files are removed from your server.

How to Revoke an SSL Certificate

If your private key is compromised or you need to cancel a certificate right away, revoke it:

sudo certbot revoke --cert-path /etc/letsencrypt/live/yourdomain.com/cert.pem

After revoking, delete it from the server too:

sudo certbot delete --cert-name yourdomain.com

How to Expand or Update Your Certificate

The –expand flag lets you add new domains to your existing certificate without creating a separate lineage:

sudo certbot --nginx --cert-name yourdomain.com -d yourdomain.com -d www.yourdomain.com -d shop.yourdomain.com

How to Redirect HTTP to HTTPS

When you run Certbot with Nginx or Apache, it asks if you want to redirect all HTTP traffic to HTTPS. You can also set this manually.

For Nginx, Certbot adds redirect rules to your config automatically when you choose that option during setup.

To force this manually in Nginx:

sudo certbot --nginx --redirect -d yourdomain.com

Useful Certbot Options

• –agree-tos – Agree to Let’s Encrypt terms automatically
• –email [email protected] – Set your email for renewal notices
• –non-interactive – Run without any prompts (good for scripts)
• –quiet – Suppress output unless there is an error
• –staging – Use the Let’s Encrypt test server (no real certificate)

Example: Get Certificate Without Any Prompts

sudo certbot --nginx -d yourdomain.com --non-interactive --agree-tos -m [email protected]

How to Check SSL Certificate Expiry

You can check when your certificate expires using this command:

sudo certbot certificates

Or use OpenSSL to check the expiry date directly:

echo | openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates

Common Certbot Errors and Fixes

Error: Port 80 is already in use

Stop your web server before running standalone mode:

sudo systemctl stop nginx
sudo certbot certonly --standalone -d yourdomain.com
sudo systemctl start nginx

Error: Too many certificates already issued

Let’s Encrypt has a rate limit of 5 certificates per domain per week. Use –staging to test without hitting the limit:

sudo certbot --nginx --staging -d yourdomain.com

Error: Domain does not resolve to this server

Make sure your domain’s DNS A record points to the correct server IP before running Certbot.

Quick Reference: Certbot Commands Cheat Sheet

• Check Certbot Version
  certbot --version

• Get certificate (Nginx)
  certbot --nginx -d domain.com

• Get certificate (Apache)
  certbot --apache -d domain.com

• List all certificates
  certbot certificates

• Renew all certificates
  certbot renew

• Force renew
  certbot renew --force-renewal

• Test renewal
  certbot renew --dry-run

• Delete a certificate
  certbot delete --cert-name domain.com

• Revoke a certificate
  certbot revoke --cert-path /path/to/cert.pem

• Add new domain
  certbot --nginx --expand -d domain.com -d new.domain.com


Conclusion

Managing SSL certificates does not have to be hard. With Certbot, you can get, renew, expand, and delete certificates using simple commands. The most important habit is to test your auto-renewal setup using –dry-run so you are never caught with an expired certificate.

Start with certbot certificates to see what you have, set up a cron job for auto-renewal, and you are all set.