Issue, renew, replicate, retire
Free certificate lifecycle management
Four ways to get a certificate, one place that keeps track of all of them, and renewal that works out which node can actually answer the challenge. No spreadsheet, no calendar reminder, and no Monday morning spent explaining an expired certificate.
The whole life of a certificate
| Stage | By hand | Here |
|---|---|---|
| Issue | certbot, or a form on a supplier's website, then move files around | One dialog. Pull the names straight off an existing site so you cannot miss one. |
| Install | Copy to the box, edit the config, reload, remember the other box | Pick it from a list on the site. It is already on every node. |
| Replicate | scp, and hope you did it everywhere | Automatic. The list shows how many nodes have a copy. |
| Renew | A timer that fires on the wrong node and fails quietly | Worked out fresh each time, with the token pushed everywhere first. |
| Watch | A calendar reminder somebody set in 2023 and then left the company | Days remaining on every certificate, with expiry warnings to an address you set. |
| Replace | Issue, install, hope nothing was still pointing at the old one | Change the certificate on the site and apply. The old one stays until you remove it. |
| Retire | Delete and find out later what was using it | Deletion is refused while any site still uses it, and it names the site. |
The cluster problem nobody warns you about
Certificate renewal on a single server is easy. On a cluster where the public address moves between nodes, the naive version fails in a way that is genuinely hard to debug.
An http challenge can only be answered by whichever node currently owns the public address for that name. Run certbot on a timer on every node and two out of three fail every single time, every renewal, forever. The failures look identical to a real problem, so when a renewal does genuinely break, the message is buried in noise you have learned to ignore.
What happens instead: at every renewal the name is looked up against public DNS, compared with what each node reports its own public address to be, and the node that matches runs the challenge. The challenge token goes to every node before validation starts, because the authority picks which address it connects to and you do not get a say. The result is then replicated to the whole fleet.
Why the distro timer is disabled
The installer switches off the packaged certbot timer deliberately. Leaving it on gives you two sources of truth fighting over the same certificates, and a stream of failure emails that trains everybody to ignore certificate alerts.
Four ways to get a certificate
- Let's Encrypt. Free, automatic, ninety day certificates that renew themselves. The default, and right for nearly everything.
- A paid authority through ACME. Give it the directory URL, a key identifier and an HMAC key from your supplier, and buying a certificate becomes the same two clicks as a free one, with automatic renewal.
- Upload one you already have. Paste or upload the certificate, the key and any intermediates. The key is checked against the certificate before anything is saved, so the classic mismatch is caught at the point of pasting.
- A signing request made here. The private key is generated on the machine and never leaves it. You send the request to your supplier and paste the certificate back when it arrives.
Wildcards and the dns challenge
A wildcard needs dns validation, which means proving control by putting a record in your DNS rather than serving a file. Put your DNS provider credentials in once, encrypted, and ask for the wildcard. It also works when your site sits behind a CDN and port 80 is not reachable.
Remember that a wildcard does not cover the apex. If you need example.com as well
as everything under it, add the bare name as a second name on the same certificate.
Staging is on by default, and that is deliberate
Let's Encrypt allows five certificates a week for the same set of names, with no appeal, and almost everybody gets the setup wrong at least once. Starting against the staging service means your mistakes are free. The certificate will not be trusted by a browser, which is the point: it proves the whole flow works before you spend a real one.
When it works, untick the staging box in Settings and issue again. Nothing else changes.
Certificate lifecycle
Issue, renew, replicate and retire, without a calendar.
Read moreLet's Encrypt certificates
Free certificates that renew themselves, in a cluster.
Read morePaid certificate authorities
Buy from DigiCert or Sectigo and still automate it.
Read moreTLS settings
Protocols, ciphers, stapling and HTTP/2 or HTTP/3.
Read morePost quantum key exchange
X25519MLKEM768 first, classic curves behind it.
Read moreBackend TLS
Speak https to your own servers, and verify it properly.
Read moreQuestions people ask
What is certificate lifecycle management?
Everything that happens to a certificate between deciding you need one and throwing it away. Issuing it, putting it where it is needed, renewing it before it expires, replacing the key, getting it onto every server that serves the name, and removing it safely afterwards. Doing that by hand for more than a handful of names is where expired certificates come from.
Is free certificate lifecycle management really free here?
Yes. The management layer is MIT licensed with no paid tier, and Let's Encrypt certificates cost nothing. If you buy certificates from a commercial authority you still pay them, but the managing, renewing and replicating is free either way.
What happens in a cluster when the public address moves?
This is the case that breaks naive setups. Only the node that currently owns the public address for a name can answer an http challenge, and which node that is changes when you fail over. At every renewal the name is looked up against public DNS and compared with what each node reports as its own public address, so the right node runs the challenge. The token is pushed to every node first, because the authority picks which one it connects to.
Why is the certbot timer switched off?
On purpose. It fires on every box, and on a node that does not own the public address the challenge fails every time. You end up with a mailbox full of failures from two of your three nodes and the real problem buried in it. Renewal is driven from the manager, which works out which node can actually answer.
Can I use a commercial certificate authority?
Yes, four ways in total: Let's Encrypt, a paid authority through ACME with an external account binding, an upload of a certificate you already have, or a signing request generated here where the private key never leaves the machine. A paid authority set up through ACME renews automatically the same way Let's Encrypt does.
Stop tracking expiry in a spreadsheet
Ubuntu 22.04 or newer, root access, and about twenty minutes. The installer does the rest and it is safe to run twice.