certbot(1)
Automatically obtain, renew, and manage SSL/TLS certificates from Let's Encrypt.
Synopsis
certbot [COMMAND] [OPTIONS] [DOMAIN ...]Description
Certbot is a free, open-source tool that automates the process of obtaining and renewing SSL/TLS certificates from Let's Encrypt certificate authority. It can automatically configure HTTPS for web servers and handles certificate renewal before expiration.
Certbot supports multiple authenticators and installers, including Apache, Nginx, and standalone modes. It uses the ACME protocol to verify domain ownership and issue certificates with minimal manual intervention.
Common options
| Flag | What it does |
|---|---|
certonly | Obtain certificate only; do not install it on the server |
-a, --authenticator | Specify authentication plugin (standalone, nginx, apache, dns-*) |
-i, --installer | Specify installer plugin (nginx, apache, etc.) |
-d, --domain | Specify domain name(s) to include in certificate; can be used multiple times |
--agree-tos | Agree to the ACME Subscriber Agreement without prompting |
-n, --non-interactive | Run in non-interactive mode, avoid user prompts |
--force-renewal | Force certificate renewal regardless of expiration date |
--dry-run | Test certificate issuance without saving certificates |
-e, --email | Email address for account recovery and notices |
renew | Renew all previously obtained certificates |
--expand | Expand existing certificate to include additional domains |
-v, --verbose | Increase verbosity of output (can be repeated) |
Examples
Obtain a certificate for example.com and www.example.com using standalone mode (no web server needed)
sudo certbot certonly --standalone -d example.com -d www.example.comObtain and automatically install a certificate on Nginx for example.com
sudo certbot --nginx -d example.comTest renewal of all certificates without making actual changes
sudo certbot renew --dry-runRenew all certificates that are close to expiration (typically run via cron)
sudo certbot renewList all certificates managed by certbot with their details and expiration dates
sudo certbot certificatesObtain a wildcard certificate using DNS validation with AWS Route53
sudo certbot certonly --dns-route53 -d example.com -d *.example.comDelete a certificate and its associated key from the system
sudo certbot delete --cert-name example.comNon-interactively obtain and install certificate on Apache with email and agreement
sudo certbot --apache -d example.com --agree-tos -m [email protected] -n