TLS certificate automation with certbot and strict renewal checks

4172 views

                  #!/usr/bin/env bash
set -euo pipefail

certbot renew --quiet --deploy-hook "systemctl reload nginx"
openssl x509 -enddate -noout -in /etc/letsencrypt/live/example.com/fullchain.pem

Certificate expiry outages are avoidable with boring automation and good alerting. I use automatic renewal, post-renew validation hooks, and external checks that warn well before expiry. TLS is not finished once the first certificate works.

Kai Nakamura

More from Kai Nakamura

TLS certificate automation with certbot and strict renewal checks

0 Comments

More from Kai Nakamura