certbot is a command-line tool for obtaining and renewing SSL/TLS certificates from Let's Encrypt, automatically configuring web servers, and managing certificate lifecycles.
Obtain a certificate for a single domain
Example Usage:
certbot certonly --standalone -d example.com --email admin@example.com --agree-tos
What it does:
Requests a certificate for a single domain using the standalone plugin (for self-hosted testing), with an email and acceptance of terms.
Command-line Arguments Explained:
certonly: Obtains a certificate without automatically configuring a web server. --standalone: Uses a standalone web server for validation (no existing server required). -d example.com: Specifies the domain name for which to obtain the certificate. --email admin@example.com: Provides the email for account registration and notifications. --agree-tos: Automatically agrees to Let's Encrypt's terms of service.
Renew all certificates
Example Usage:
certbot renew --dry-run
What it does:
Tests certificate renewal without making changes, useful for verifying renewal processes.
Command-line Arguments Explained:
renew: Renew certificates that are nearing expiration. --dry-run: Simulates renewal without actual certificate changes.
Register an account with Let's Encrypt
Example Usage:
certbot register --email admin@example.com --agree-tos
What it does:
Registers a new Let's Encrypt account using the provided email and terms of service.
Command-line Arguments Explained:
register: Creates a new account. --email: Email for account contact. --agree-tos: Accepts the Let's Encrypt terms of service.
Revoke a certificate
Example Usage:
certbot revoke --certificate /etc/letsencrypt/live/example.com/fullchain.pem --email admin@example.com
What it does:
Revokes an existing certificate, requiring the certificate path and account email.
Command-line Arguments Explained:
revoke: Deletes a certificate from Let's Encrypt. --certificate: Path to the certificate file (e.g., fullchain.pem). --email: Email associated with the account to authenticate the revocation.
Run interactive setup with Nginx plugin
Example Usage:
certbot --nginx -d example.com -d www.example.com --agree-tos
What it does:
Automatically configures Nginx to use a certificate for specified domains.
Command-line Arguments Explained:
--nginx: Uses the Nginx plugin to modify server configurations. -d example.com -d www.example.com: Lists domains to be protected. --agree-tos: Accepts the Let's Encrypt terms of service.
Use DNS challenge for manual domain validation
Example Usage:
certbot certonly --manual --preferred-challenges dns -d example.com
What it does:
Requests a certificate using the DNS validation method, requiring manual DNS record setup.
Command-line Arguments Explained:
--manual: Manual interaction for domain validation. --preferred-challenges dns: Chooses DNS-based validation over HTTP. -d example.com: Specifies the domain to verify.
Test certificate issuance without saving it
Example Usage:
certbot certonly --test-cert -d example.com --key-path /path/to/key.pem
What it does:
Obtains a test certificate (not saved to disk) to validate configuration.
Command-line Arguments Explained:
--test-cert: Uses a test certificate for validation. -d example.com: Domain name for testing. --key-path: Specifies where to save the private key (optional).
Renew a specific certificate
Example Usage:
certbot renew --cert-name example.com --force-renewal
What it does:
Forces renewal of a specific certificate (e.g., if it's expiring soon).
Command-line Arguments Explained:
renew: Renew certificates scheduled for expiration. --cert-name: Identifies the certificate to renew. --force-renewal: Overrides automatic checks and renews regardless of time.
Example Usage:
certbot --apache -d example.com --non-interactive
What it does:
Automatically requests a certificate and updates Apache configurations.
Command-line Arguments Explained:
--apache: Uses the Apache plugin to modify server settings. -d example.com: Domain to secure. --non-interactive: Runs without prompts, assuming defaults.
Use standalone mode with custom port
Example Usage:
certbot certonly --standalone --port 8080 -d example.com
What it does:
Uses the standalone plugin and specifies a custom port for validation.
Command-line Arguments Explained:
--standalone: Runs a temporary web server for validation. --port 8080: Overrides the default port (80/443) for the standalone server. -d example.com: Domain to validate.
Request a certificate with a custom config
Example Usage:
certbot certonly --config /etc/letsencrypt/custom.conf -d example.com
What it does:
Uses a custom configuration file to request a certificate.
Command-line Arguments Explained:
--config: Path to a custom configuration file. -d example.com: Domain name.
Display help summary
Example Usage:
certbot --help
What it does:
Shows the main help menu with available commands and options.
Command-line Arguments Explained:
--help: Displays usage instructions and command descriptions.
Check certificate status
Example Usage:
certbot certificates
What it does:
Lists all certificates installed on the system and their details.
Command-line Arguments Explained:
certificates: Displays installed certificates and their expiration dates.
Run in verbose mode
Example Usage:
certbot --verbose renew
What it does:
Provides detailed logs during certificate renewal for troubleshooting.
Command-line Arguments Explained:
--verbose: Increases output verbosity for debugging.
Configure multiple domains at once
Example Usage:
certbot certonly --nginx -d example.com -d blog.example.com
What it does:
Requests a certificate for multiple domains using the Nginx plugin.
Command-line Arguments Explained:
--nginx: Applies to Nginx. -d example.com -d blog.example.com: Comma-separated or multiple -d flags for domains.
Example Usage:
certbot --nginx --pre-hook "systemctl stop nginx" -d example.com
What it does:
Runs a command before restarting the web server during certificate installation.
Command-line Arguments Explained:
--pre-hook: Executes a command before the server restart (e.g., stopping services). --nginx: Uses the Nginx plugin. -d example.com: Domain to secure.
