Let's Encrypt certificates last 90 days and renew on their own about 30 days before they expire, as long as Certbot's timer or cPanel AutoSSL is running. The timer checks twice a day. A dry run, or a later expiry in SSL/TLS Status, is how you know the next renewal will succeed.
What does Let's Encrypt auto renew do?
Let's Encrypt issues a certificate for 90 days. Auto renew means an ACME client requests a replacement before that date, usually when about 30 days remain, and installs it. The certificate is free. Nothing renews if the client is missing or its schedule is off.
WebJi® hosting includes that free certificate for the site on the plan. Order from the SSL certificate page when you need a wildcard, organization validation, or a certificate for a server outside that offer. The free and paid SSL comparison is that decision. Renewal of the free certificate is a different job.
Where does the renewal run?
The client follows whoever controls the server. On shared cPanel you do not install Certbot yourself. On a Linux VPS with root, Certbot's own timer is the client. A Windows server needs an ACME client that its panel supports.
| Where the site lives | What renews it | How you know it worked |
|---|---|---|
| WebJi® cPanel hosting | AutoSSL with the included Let's Encrypt certificate | SSL/TLS Status shows a later expiry |
| Linux VPS with Certbot | A systemd timer or cron that runs certbot renew twice a day | A dry run says the simulated renewals succeeded |
| WebJi® Windows hosting (Plesk) | The certificate task in Plesk | The panel shows a new expiry date |
Windows hosting here uses Plesk. Use the certificate task in that panel, and read the new expiry there. An unmanaged Windows server needs its own ACME client. Do not install Certbot on a cPanel account.
If the certificate is not on the server yet, install it before you test renewal. The Nginx Certbot guide is that install on a VPS. On cPanel, open SSL/TLS Status and run AutoSSL. The cPanel SSL install guide is those clicks. Email support@webji.services if the row stays failed. That mailbox is staffed 24/7 in Hindi and English.
How do you check the timer and the expiry?
Read the expiry the public site is actually serving, then confirm a schedule exists. A certificate with 60 days left is not late. A certificate with no timer will die on day 90 even if it looks fine today.
- In cPanel, open SSL/TLS Status and read the expiry for the bare domain and for www if you use it. A future date means AutoSSL has a certificate. A past date means the last run failed.
- On a Linux VPS, run
systemctl list-timersand look forcertbot.timerorsnap.certbot.renew.timer. You want a last run and a next run. If neither unit exists, check root's crontab for acertbot renewline. - Run
sudo certbot certificatesand read the expiry line. After a real renewal and a server reload, that date and the browser padlock date should match.
No timer and no cron means renewal is not automatic. Install the timer with the Certbot package, or turn AutoSSL back on, before you wait for the 30-day window.
What does a dry run prove?
sudo certbot renew --dry-run performs the challenge against Let's Encrypt's staging server. It does not replace the live certificate. The pass line says the simulated renewals succeeded. Any error is the same error a real renewal would hit, and the current certificate stays in place.
sudo certbot renew with no extra flag renews only certificates already inside the renewal window, about 30 days before expiry. If it reports that no renewal was attempted, the certificate is not due. That result does not prove the challenge works. Use the dry run for the proof.
A passed dry run with an old padlock date means the web server is still serving the previous files. The Apache and Nginx plugins reload the server after a real renewal. A webroot install needs a deploy hook that reloads it. Check the padlock date again after that reload.
Why does an HTTP-01 renewal fail?
HTTP-01 asks Let's Encrypt to fetch a token from http://your-domain/.well-known/acme-challenge/ on port 80. The renewal fails when the public fetch does not receive that token. Fix one cause, then dry-run again.
- From a network outside the server, request
http://your-domain/.well-known/acme-challenge/test. A 404 shows that port 80 reached this machine. A timeout is a firewall or the wrong address. - The final page must be the token, not the homepage. A redirect is fine only when the address it lands on still returns the token.
- The A and AAAA records must point at the server running the client. After a migration, stale DNS is a common miss.
- If a CAA record exists, it has to allow
letsencrypt.org. A list that names only another issuer blocks the renewal. - Run
sudo certbot renew --dry-runagain. Stop when it says the simulated renewals succeeded.
Can you renew a certificate that already expired?
Yes. Expiry does not delete the renewal config. sudo certbot renew will try an expired certificate that still has a file under /etc/letsencrypt/renewal/. The browser warning remains until the new files are loaded and the web server reloads.
If that directory has no file for the name, issue the certificate again with the original command. Do not create a second copy for names that already have a lineage. On cPanel, Run AutoSSL still works after the date has passed. Email support@webji.services with the hostname if the row stays red and you have no shell.
When should you not force a renewal?
sudo certbot renew --force-renewal replaces a certificate that is not due. Use it once, after a dry run has passed, when you changed the set of names on purpose. It is not the repair for a failed challenge.
Let's Encrypt limits how many duplicate certificates the same names can receive in a short period. A loop of force renewals hits that limit and blocks the next real certificate. Fix the challenge, then let the timer renew inside the 30-day window. On cPanel, use Run AutoSSL once. Do not click it in a loop.
Frequently Asked Questions
Does Let's Encrypt renew certificates automatically?
Let's Encrypt renews a certificate only when an ACME client is scheduled. On WebJi® cPanel hosting that client is AutoSSL. On a Linux VPS it is Certbot's timer, which checks twice a day and renews about 30 days before the 90-day expiry.
How often should a Let's Encrypt certificate renew?
The certificate is valid for 90 days. Renew it when about 30 days remain. Certbot does not renew on a calendar date such as the first of the month. It checks twice a day and skips certificates that are not inside that window.
What is the Certbot command to renew a certificate?
Run sudo certbot renew to renew certificates that are already due. Run sudo certbot renew --dry-run to test the challenge without replacing the live certificate. Add --force-renewal only when you intend to replace a certificate that is not due, and only once.
Can you renew an expired Let's Encrypt certificate?
Yes, if the renewal config is still on the server. Run sudo certbot renew, then reload the web server so visitors receive the new files. On cPanel, open SSL/TLS Status and run AutoSSL. The browser warning clears only when the new certificate is the one being served.
Why did my Let's Encrypt renewal fail?
The usual cause is the HTTP-01 fetch. Port 80 is blocked, the challenge path does not return the token, DNS points at the old server, or a CAA record does not allow Let's Encrypt. The dry run prints the cause. Fix that one item and run the dry run again.
Does cPanel AutoSSL use Let's Encrypt?
On WebJi® cPanel hosting, the included free certificate is Let's Encrypt and AutoSSL renews it. You do not install Certbot on that account. A paid certificate ordered from the SSL page is a separate install. It does not replace the AutoSSL check for the free certificate.