org-howto/articles/2026/08/autorenew-certificate.org

• Problem
• Plan
  • Renew Certificate
  • Certbot Renewal Service
  • Renewal Timer
  • Renew Certificate
  • Verify

#+title [16aug2026] setup autorenewing certificate on cloud host

#

#

#

#

#

#

#

Problem

Self-signed certificate expired on my cloud host vpn1.

Plan

Setup systemd services to renew certificate automagically. We are using nix to provide the services themselves.

Renew Certificate

To renew certificate immediately:

  $ ssh vpn1
  sudo /nix/var/nix/profiles/default/bin/nix run nixpkgs#certbot -- renew \
  	 --pre-=hook 'systemctl stop nginx' \
  	 --post-hook 'systemctl start nginx'

Certbot Renewal Service

${certbot} is store path to the certificate bot.

    # /etc/systemd/system/certbot-renew.service

    [Unit]
    Description=Renew Let's Encrypt certificates (fleet-managed)
    After=network-online.target
    Wants=network-online.target

    [Service]
    Type=oneshot
    ExecStart=${certbot}/bin/certbot renew --non-interactive \
        --pre-hook  '/usr/bin/systemctl stop nginx' \
        --post-hook '/usr/bin/systemctl start nginx'

    # Safety net: if certbot dies between hooks,
    # nginx stays down and takes forgejo and CI with it until a human notices
    #
    ExecStopPost=-/usr/bin/systemctl --no-block start nginx

Renewal Timer

Timer to check certificate and autorenew

    # /etc/systemd/system/certbot-renew.timer

    [Unit]
    Description=Twice-daily Let's Encrypt renewal check (fleet-managed)

    [Timer]
    OnCalendar=*-*-* 03,15:00:00
    RandomizedDelaySec=1h
    Persistent=true

    [Install]
    WantedBy=timers.target

Renew Certificate

After establishing new /etc/systemd content:

  $ ssh vpn1
  $ sudo systemctl daemon-reload
  $ sudo systemctl enable --now certbot-renew.timer

Verify

  $ ssh vpn1
  sudo systemctl --no-pager --full status nginx \ head -n 6
  sudo systemctl --no-pager list-timers certbot-renew.timer

Can also browse:

• https://conybeare.us nginx default landing page at present
• https://conybeare.us/git forgejo git hosting