Cheatsheet & Examples: certbot

certbot is a command-line tool for obtaining and renewing SSL/TLS certificates from Let's Encrypt, automatically configuring web servers, and managing certificate lifecycles.

Obtain a certificate for a single domain

Example Usage:
certbot certonly --standalone -d example.com --email admin@example.com --agree-tos
What it does:
Requests a certificate for a single domain using the standalone plugin (for self-hosted testing), with an email and acceptance of terms.
Command-line Arguments Explained:

• certonly: Obtains a certificate without automatically configuring a web server.
• --standalone: Uses a standalone web server for validation (no existing server required).
• -d example.com: Specifies the domain name for which to obtain the certificate.
• --email admin@example.com: Provides the email for account registration and notifications.
• --agree-tos: Automatically agrees to Let's Encrypt's terms of service.

Renew all certificates

Example Usage:
certbot renew --dry-run
What it does:
Tests certificate renewal without making changes, useful for verifying renewal processes.
Command-line Arguments Explained:

• renew: Renew certificates that are nearing expiration.
• --dry-run: Simulates renewal without actual certificate changes.

Register an account with Let's Encrypt

Example Usage:
certbot register --email admin@example.com --agree-tos
What it does:
Registers a new Let's Encrypt account using the provided email and terms of service.
Command-line Arguments Explained:

• register: Creates a new account.
• --email: Email for account contact.
• --agree-tos: Accepts the Let's Encrypt terms of service.

Revoke a certificate

Example Usage:
certbot revoke --certificate /etc/letsencrypt/live/example.com/fullchain.pem --email admin@example.com
What it does:
Revokes an existing certificate, requiring the certificate path and account email.
Command-line Arguments Explained:

• revoke: Deletes a certificate from Let's Encrypt.
• --certificate: Path to the certificate file (e.g., fullchain.pem).
• --email: Email associated with the account to authenticate the revocation.

Run interactive setup with Nginx plugin

Example Usage:
certbot --nginx -d example.com -d www.example.com --agree-tos
What it does:
Automatically configures Nginx to use a certificate for specified domains.
Command-line Arguments Explained:

• --nginx: Uses the Nginx plugin to modify server configurations.
• -d example.com -d www.example.com: Lists domains to be protected.
• --agree-tos: Accepts the Let's Encrypt terms of service.

Use DNS challenge for manual domain validation

Example Usage:
certbot certonly --manual --preferred-challenges dns -d example.com
What it does:
Requests a certificate using the DNS validation method, requiring manual DNS record setup.
Command-line Arguments Explained:

• --manual: Manual interaction for domain validation.
• --preferred-challenges dns: Chooses DNS-based validation over HTTP.
• -d example.com: Specifies the domain to verify.

Test certificate issuance without saving it

Example Usage:
certbot certonly --test-cert -d example.com --key-path /path/to/key.pem
What it does:
Obtains a test certificate (not saved to disk) to validate configuration.
Command-line Arguments Explained:

• --test-cert: Uses a test certificate for validation.
• -d example.com: Domain name for testing.
• --key-path: Specifies where to save the private key (optional).

Renew a specific certificate

Example Usage:
certbot renew --cert-name example.com --force-renewal
What it does:
Forces renewal of a specific certificate (e.g., if it's expiring soon).
Command-line Arguments Explained:

• renew: Renew certificates scheduled for expiration.
• --cert-name: Identifies the certificate to renew.
• --force-renewal: Overrides automatic checks and renews regardless of time.

Auto-configure Apache server

Example Usage:
certbot --apache -d example.com --non-interactive
What it does:
Automatically requests a certificate and updates Apache configurations.
Command-line Arguments Explained:

• --apache: Uses the Apache plugin to modify server settings.
• -d example.com: Domain to secure.
• --non-interactive: Runs without prompts, assuming defaults.

Use standalone mode with custom port

Example Usage:
certbot certonly --standalone --port 8080 -d example.com
What it does:
Uses the standalone plugin and specifies a custom port for validation.
Command-line Arguments Explained:

• --standalone: Runs a temporary web server for validation.
• --port 8080: Overrides the default port (80/443) for the standalone server.
• -d example.com: Domain to validate.

Request a certificate with a custom config

Example Usage:
certbot certonly --config /etc/letsencrypt/custom.conf -d example.com
What it does:
Uses a custom configuration file to request a certificate.
Command-line Arguments Explained:

• --config: Path to a custom configuration file.
• -d example.com: Domain name.

Display help summary

Example Usage:
certbot --help
What it does:
Shows the main help menu with available commands and options.
Command-line Arguments Explained:

• --help: Displays usage instructions and command descriptions.

Check certificate status

Example Usage:
certbot certificates
What it does:
Lists all certificates installed on the system and their details.
Command-line Arguments Explained:

• certificates: Displays installed certificates and their expiration dates.

Run in verbose mode

Example Usage:
certbot --verbose renew
What it does:
Provides detailed logs during certificate renewal for troubleshooting.
Command-line Arguments Explained:

• --verbose: Increases output verbosity for debugging.

Configure multiple domains at once

Example Usage:
certbot certonly --nginx -d example.com -d blog.example.com
What it does:
Requests a certificate for multiple domains using the Nginx plugin.
Command-line Arguments Explained:

• --nginx: Applies to Nginx.
• -d example.com -d blog.example.com: Comma-separated or multiple -d flags for domains.

Auto-configure a web server with a pre-restart hook

Example Usage:
certbot --nginx --pre-hook "systemctl stop nginx" -d example.com
What it does:
Runs a command before restarting the web server during certificate installation.
Command-line Arguments Explained:

• --pre-hook: Executes a command before the server restart (e.g., stopping services).
• --nginx: Uses the Nginx plugin.
• -d example.com: Domain to secure.