How to renew only one domain with certbot?

lets-encrypt certbot
e-info128 picture e-info128 · Mar 4, 2017 · Viewed 101.1k times · Source

I have multiple domains with multiple certificates:

$ ll /etc/letsencrypt/live/
> domain1.com
> domain2.com
> domain3.com
> ...

I need to renew only domain1.com, but the command certbot renew renews certificates for all domains. How can I renew certain certificate explicitly?

Answer

Baker picture Baker · Feb 25, 2018

Renew a single certificate using renew with the --cert-name option.

(certonly creates a certificate for one or more domains, replacing it if exists).

Example

certbot renew --cert-name domain1.com --dry-run

Remove --dry-run to actually renew.

Cert-name != Domain name

Note that the value supplied to --cert-name option is a certificate name (not a domain name) found using

certbot certificates

Returning a list like

-------------------------------------------------------------------------------
Found the following certs:
  Certificate Name: myfundomains.com
    Domains: myfundomains.com
    Expiry Date: 2018-05-04 04:28:05+00:00 (VALID: 67 days)
    Certificate Path: /etc/letsencrypt/live/myfundomains.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/myfundomains.com/privkey.pem
  Certificate Name: ask.myfundomain.com
    Domains: ask.myfundomain.com
    Expiry Date: 2018-03-13 18:59:40+00:00 (VALID: 16 days)
    Certificate Path: /etc/letsencrypt/live/ask.myfundomain.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/ask.myfundomain.com/privkey.pem
  Certificate Name: forums.myfundomain.com
    Domains: forums.myfundomain.com forum.myfundomain.com
    Expiry Date: 2018-04-11 16:39:18+00:00 (VALID: 45 days)
    Certificate Path: /etc/letsencrypt/live/forums.myfundomain.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/forums.myfundomain.com/privkey.pem
-------------------------------------------------------------------------------

Notice how the third Certificate name (forums.myfundomain.com) contains multiple domains:

  • forums.myfundomains.com
  • forum.myfundomains.com

Restart Apache / nginx

-------------------------------------------------------------------------------
new certificate deployed without reload, fullchain is
/etc/letsencrypt/live/ask.myfundomain.com/fullchain.pem
-------------------------------------------------------------------------------

Remember to restart your webserver to make use of the new certificate.

Related questions

How to uninstall/remove Certbot Let's Encrypt from Debian 8

I just followed the instuctions found on : https://certbot.eff.org/#debianjessie-apache to install let's encrypt certificate on my linux vps. but unfortunately, installation did not went as I expected because : A. I already had an instance of apache2 installed …

Read More
Certbot /.well-known/acme-challenge

Should I leave the /.well-known/acme-challenge always exposed on the server? Here is my config for the HTTP: server { listen 80; location '/.well-known/acme-challenge' { root /var/www/demo; } location / { if ($scheme = http) { return 301 https://$server_name$request_uri; } } Which basically …

Read More
Issue using certbot with nginx

I'm actually working on a webapp, I use Reactjs for the frontend and Golang for the backend. Those 2 programs are hosted separately on 2 VMs on Google-Compute-Engine. I want to serve my app through https so I choose to use Nginx …

Read More