Krishan Chawla

Back

Let's Encrypt — Useful Commands & Troubleshooting

Quick-access Let's Encrypt and Certbot commands for issuing, renewing, verifying SSL/TLS certificates, plus common troubleshooting steps.

🔐 Certificate command cli

Let’s Encrypt — Useful Commands & Troubleshooting#

A compact toolbox of common Certbot commands, copy-ready snippets, and real-world fixes engineers frequently use while working with Let’s Encrypt.
This is not a step-by-step guide — just the things you actually search for in production.

🔧 Install Certbot#

Ubuntu / Debian#

sudo apt update
sudo apt install certbot python3-certbot-nginx
bash

RHEL / CentOS#

sudo dnf install certbot python3-certbot-nginx
bash

🔒 Issue New Certificates#

Issue certificate (NGINX)#

sudo certbot --nginx -d example.com -d www.example.com
bash

Issue certificate (Apache)#

sudo certbot --apache -d example.com
bash

Standalone mode (when no web server is running)#

sudo certbot certonly --standalone -d example.com
bash

DNS Challenge (e.g., Cloudflare)#

Useful for wildcard certificates.

sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials ~/.secrets/cloudflare.ini \
  -d example.com -d '*.example.com'
bash

♻️ Renewal Commands#

Test renewal#

sudo certbot renew --dry-run
bash

Force renewal#

sudo certbot renew --force-renewal
bash

Check auto-renew timer (systemd)#

systemctl list-timers | grep certbot
bash

📂 Certificate File Locations#

/etc/letsencrypt/live/<domain>/fullchain.pem
/etc/letsencrypt/live/<domain>/privkey.pem
/etc/letsencrypt/live/<domain>/chain.pem
plaintext

🧪 Verification Commands#

Check certificate expiry#

sudo openssl x509 -in /etc/letsencrypt/live/example.com/cert.pem -noout -enddate
bash

View certificate details#

sudo openssl x509 -in fullchain.pem -noout -text
bash

Test HTTPS endpoint#

curl -I https://example.com
bash

🐞 Common Errors & Fixes#

❗ Port 80 Already in Use#

Problem binding to port 80.
plaintext

Find process:

sudo lsof -i :80
bash

Stop conflicting service:

sudo systemctl stop <service>
bash

Alternatively use DNS challenge:

sudo certbot certonly --dns-cloudflare ...
bash

❗ NGINX Plugin Not Found#

The nginx plugin is not installed.
plaintext

Install plugin:

sudo apt install python3-certbot-nginx
bash

❗ Cloudflare SSL Errors (525 / handshake failed)#

Fix checklist:

  • Set Cloudflare SSL mode → Full, not “Full (Strict)”
  • Disable “Always Use HTTPS” temporarily
  • Ensure server certificate is valid

❗ Auto-Renew Not Executing#

Check logs:

sudo cat /var/log/letsencrypt/letsencrypt.log
bash

Run manually:

sudo certbot renew --dry-run
bash

❗ Wildcard certificate not issued#

Wildcard certificates require DNS-01 challenge — HTTP-01 cannot issue them.

🧰 Utility Commands#

List installed certificates#

sudo certbot certificates
bash

Delete a certificate#

sudo certbot delete --cert-name example.com
bash

Reload web server after renewal#

NGINX:

sudo systemctl reload nginx
bash

Apache:

sudo systemctl reload apache2
bash

📝 Tip#

If you’re using Load Balancers, Proxies, or Cloudflare in front of your server, always ensure that:

  • Port 80 is reachable for HTTP-01 challenges
  • DNS records propagate before re-issuing
  • Certificates are reloaded after renewal

Related DevTools

command →

Maven Useful Commands

Maven commands to quickly get you going.

Published: 12/8/2025

Back to DevTools