How Let's Encrypt auto renew works
Let’s Encrypt auto-renewal requires an ACME client that is scheduled, can validate the names and deploys the replacement certificate. Check actual certificate lifetime and client version: current Certbot uses lifetime-based renewal thresholds. A dry run tests staging validation but leaves the live certificate unchanged and does not guarantee the next production renewal.
For website administrators checking certificate renewal, with client-version, validation and deployment checks instead of a universal expiry window or padlock-based assumption.
knowledge
- Read time
- 5 min
- Sections
- 7
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
Let's Encrypt certificates last 90 days and renew on their own about 30 days before they expire, as long as Certbot's timer or cPanel AutoSSL is running. The timer checks twice a day. A dry run, or a later expiry in SSL/TLS Status, is how you know the next renewal will succeed.
What does Let's Encrypt auto renew do?
Let’s Encrypt auto-renewal means a configured ACME client requests and installs a replacement before expiry. Check the certificate’s actual lifetime and the client’s renewal policy rather than assuming every profile has a fixed 90-day lifetime.
WebJi® hosting includes that free certificate for the site on the plan. Order from the SSL certificate page when you need a wildcard, organization validation, or a certificate for a server outside that offer. The free and paid SSL comparison is that decision. Renewal of the free certificate is a different job.
Where does the renewal run?
The client follows whoever controls the server. On shared cPanel you do not install Certbot yourself. On a Linux VPS with root, Certbot's own timer is the client. A Windows server needs an ACME client that its panel supports.
| Where the site lives | What renews it | How you know it worked |
|---|---|---|
| WebJi® cPanel hosting | AutoSSL with the included Let's Encrypt certificate | SSL/TLS Status shows a later expiry |
| Linux VPS with Certbot | A systemd timer or cron that runs certbot renew twice a day | Dry-run validation plus a later real renewal and confirmed served certificate |
| WebJi® Windows hosting (Plesk) | The certificate task in Plesk | The panel shows a new expiry date |
Windows hosting here uses Plesk. Use the certificate task in that panel, and read the new expiry there. An unmanaged Windows server needs its own ACME client. Do not install Certbot on a cPanel account.
If the certificate is not on the server yet, install it before you test renewal. The Nginx Certbot guide is that install on a VPS. On cPanel, open SSL/TLS Status and run AutoSSL. The cPanel SSL install guide is those clicks. Email support@webji.services if the row stays failed. That mailbox is staffed 24/7 in Hindi and English.
How do you check the timer and the expiry?
Check both the certificate served publicly and the configured renewal schedule. A future expiry does not prove renewal is active; the installed client and certificate lifetime determine when the next attempt is due.
- In cPanel, open SSL/TLS Status and read the expiry for the bare domain and for www if you use it. A future date means AutoSSL has a certificate. A past date means the last run failed.
- On a Linux VPS, run
systemctl list-timersand look forcertbot.timerorsnap.certbot.renew.timer. You want a last run and a next run. If neither unit exists, check root's crontab for acertbot renewline. - Run
sudo certbot certificatesand read the expiry line. After a real renewal and a server reload, that date and the browser padlock date should match.
Confirm the renewal method appropriate to the actual installation: package timer, cron or panel-managed task. Do not install a second conflicting client just because one timer name is absent.
What does a dry run prove?
certbot renew --dry-run tests renewal against a staging CA without replacing the live certificate. It is a useful validation test, not proof that the next production renewal will succeed. Pre/post hooks may run; deploy hooks are skipped unless explicitly enabled.
certbot renew acts only on certificates due under the installed version’s policy. From Certbot 4.0.0, the threshold is less than one third of certificate lifetime, or one half for lifetimes of ten days or less; older versions used a fixed 30-day threshold.
A successful dry run normally leaves the production certificate and expiry unchanged. After a real renewal, compare the certificate served by the web endpoint with the installed lineage and verify any required deploy hook or service reload.
Why does an HTTP-01 renewal fail?
HTTP-01 renewal fails when the CA cannot validate the required challenge token through the permitted public HTTP route. HTTP-01 asks Let's Encrypt to fetch a token from http://your-domain/.well-known/acme-challenge/ on port 80. The renewal fails when the public fetch does not receive that token. Fix one cause, then dry-run again.
- A response from a test challenge path shows that an HTTP server answered, not which backend handled it. Confirm public DNS, the serving endpoint and that the actual token is available through the validation path.
- The final page must be the token, not the homepage. A redirect is fine only when the address it lands on still returns the token.
- The A and AAAA records must point at the server running the client. After a migration, stale DNS is a common miss.
- If a CAA record exists, it has to allow
letsencrypt.org. A list that names only another issuer blocks the renewal. - Run
sudo certbot renew --dry-runagain. Stop when it says the simulated renewals succeeded.
Can you renew a certificate that already expired?
Yes. Expiry does not delete the renewal config. sudo certbot renew will try an expired certificate that still has a file under /etc/letsencrypt/renewal/. The browser warning remains until the new files are loaded and the web server reloads.
If that directory has no file for the name, issue the certificate again with the original command. Do not create a second copy for names that already have a lineage. On cPanel, Run AutoSSL still works after the date has passed. Email support@webji.services with the hostname if the row stays red and you have no shell.
When should you not force a renewal?
A forced renewal is not the repair for failed domain validation. Use the documented certificate reconfiguration procedure when changing names, and reserve forcing replacement for a specific operational need after checking limits and deployment behaviour.
Avoid repeated forced attempts. Fix validation and scheduling, then allow the installed client to renew under its actual policy. Inspect applicable CA rate limits instead of treating a force-renew loop as a recovery method.
Frequently asked questions
Does Let's Encrypt renew certificates automatically?
The CA does not renew a certificate by itself. An installed and scheduled ACME client must validate, obtain and deploy the replacement. On a panel-managed account, confirm the actual client and issuer. A current certificate or passed staging test does not guarantee future renewal.
How often should a Let's Encrypt certificate renew?
Use the installed ACME client’s schedule and the certificate’s actual lifetime. Certbot 4.0.0 and later use a lifetime-based renewal threshold rather than a universal 30-day window. Check configured timers or cron and monitor failed attempts independently of the certificate’s current expiry.
What is the Certbot command to renew a certificate?
Run sudo certbot renew to renew certificates that are already due. Run sudo certbot renew --dry-run to test the challenge without replacing the live certificate. Add --force-renewal only when you intend to replace a certificate that is not due, and only once.
Can you renew an expired Let's Encrypt certificate?
Yes, if the renewal config is still on the server. Run sudo certbot renew, then reload the web server so visitors receive the new files. On cPanel, open SSL/TLS Status and run AutoSSL. The browser warning clears only when the new certificate is the one being served.
Why did my Let's Encrypt renewal fail?
The usual cause is the HTTP-01 fetch. Port 80 is blocked, the challenge path does not return the token, DNS points at the old server, or a CAA record does not allow Let's Encrypt. The dry run prints the cause. Fix that one item and run the dry run again.
Does cPanel AutoSSL use Let's Encrypt?
AutoSSL uses the provider configured by the host, which may include Let’s Encrypt where supported and enabled. Inspect the actual issuer and panel settings rather than assuming every account uses one CA. Panel-managed renewal and a separately installed Certbot lineage should not be confused.
Last editorial update: 14 November 2026.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.