---
title: "Automated Certificate Renewals on RHEL"
canonical: "https://kb.uconn.edu/space/IKB/28948365313/Automated%20Certificate%20Renewals%20on%20RHEL"
format: markdown
---
> ⚠️ The Information Security Office highly recommends users automate certificate renewals wherever possible using ACME. If you have a service that is unable to renew via ACME, such as an appliance, you can contact the security office at [security@uconn.edu](mailto:security@uconn.edu) to discuss alternatives for automated renewals.

This guide is meant to assist users in configuring automated certificate renewals for websites running on RedHat Enterprise Linux (8/9/10) using [Certbot](https://certbot.eff.org/) for ACME automation.

> ℹ️ Certbot requires Snap to be installed in order to function properly. There is a version of Certbot packaged into the Linux EPEL repository, but it is outdated and should not be used according to University policy.

## Certbot Installation

### Configure Repository

Configure a repo in accordance with your RHEL version:

<details>
<summary>RHEL 10</summary>

1. Create a new repo file:
2. Within the new file, paste the following:
3. Save the file
</details>

<details>
<summary>RHEL 9</summary>

1. Create a new repo file:
2. Within the new file, paste the following:
3. Save the file
</details>

<details>
<summary>RHEL 8</summary>

1. Create a new repo file:
2. Within the new file, paste the following:
3. Save the file
</details>

### Install Snap

```
sudo dnf -y install snapd
```

### Enable Service

> ⚠️ Failure to do this will result in snap/certbot not starting after server reboot.

```
sudo systemctl enable --now snapd.socket
```

### Create Links for Snap

```
sudo ln -s /var/lib/snapd/snap /snap
```

### Install Certbot

> ℹ️ If you just installed snap, you may receive an error stating it is not available yet. Wait 30 seconds and then try the command again.

```
sudo snap install certbot --classic
```

### Create Links for Certbot

```
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot
```

---

## Certbot Setup

### Verify Running & Version

```shell
certbot --version
```

### Discover Site Names

If you are running Nginx or Apache and want to get a list of websites running, select your corresponding website engine and run its command.

<details>
<summary>Nginx</summary>

```shell
nginx -T 2>/dev/null | awk '/^[[:space:]]*server_name[[:space:]]/ {
    gsub(/^[[:space:]]*server_name[[:space:]]+|;/,"")
    if ($0 != "_") print
}' | sort -u
```
</details>

<details>
<summary>Apache/HTTPD</summary>

```shell
httpd -S 2>/dev/null | awk '
function flush() {
    if (host != "") {
        line = host
        for (i = 1; i <= n; i++) line = line " " aliases[i]
        if (!seen[line]++) print line
    }
}
/namevhost/ {
    flush()
    host = $4
    n = 0
    delete aliases
    next
}
/^[[:space:]]+alias[[:space:]]+/ {
    aliases[++n] = $2
}
END { flush() }'
```
</details>

### Create Certbot Account

Log in to CertiNext and create an ACME API credential.

Run the following command, replacing the missing fields with the generated credential details and website admin contact information:

```
certbot register --server https://acme-us.certinext.io/v1/directory --eab-kid <KEY_ID> --eab-hmac-key <HMAC_KEY> --email <WEB_ADMIN_EMAIL> --agree-tos  --no-eff-email
```

### Request Certificate

> ℹ️ If your site has multiple FQDNs (for example, on the same line in the commands above), the **-d **flag with comma separated values, **-d <DOMAIN_1>,<DOMAIN_2>,<DOMAIN_3>** to create a SAN certificate with all names. If the command output shows multiple newlines, each requires a certificate, so rerun the command and update the **-d <DOMAIN>** flag(s) accordingly.

Select and then run the corresponding command for your website engine. 

<details>
<summary>Nginx</summary>

```
certbot --verbose run --nginx \
	--agree-tos \
	--non-interactive \
	--key-type rsa \
	--rsa-key-size 4096 \
	--issuance-timeout 600 \
    --server https://acme-us.certinext.io/v1/directory \
	--user-agent-comment "Certbot\<HOSTNAME>" \
	-d <DOMAIN>
```
</details>

<details>
<summary>Apache/HTTPD</summary>

> ⚠️ Ensure mod_ssl is installed prior to generating a certificate. If mod_ssl is not installed, Certbot will create the certificate but will be unable to hook it into Apache. 
> ⚠️ 
> ⚠️ ```
> ⚠️ sudo dnf install -y mod_ssl
> ⚠️ ```

```
certbot --verbose run --apache \
	--agree-tos \
	--non-interactive \
	--key-type rsa \
	--rsa-key-size 4096 \
	--issuance-timeout 600 \
    --server https://acme-us.certinext.io/v1/directory \
	--user-agent-comment "Certbot\<HOSTNAME>" \
	-d <DOMAIN>
```
</details>

<details>
<summary>Standalone/Cert Only</summary>

> ℹ️ Using this method will require you to configure the service that is using the certificate to use the generated certificate. The certificate files are always renewed in the same directory using the same names. Old certificates are automatically moved into an archived directory.

```
certbot --verbose certonly --manual \
	--manual-auth-hook /usr/bin/true \
	--agree-tos \
	--non-interactive \
	--key-type rsa \
	--rsa-key-size 4096 \
	--issuance-timeout 600 \
    --server https://acme-us.certinext.io/v1/directory \
	--user-agent-comment "Certbot\<HOSTNAME>" \
	-d <DOMAIN>
```
</details>

---

## Force Renewing

If you would like to force renew a certificate, run the following commands.

###  List existing certificates

Run the following command to get the list of renewalbe certificates

```
certbot certificates
```

### Select certificate

Copy the Certificate Name for the one you want to force renew

### Force renew

Run the following command, replacing CERT_NAME with the value you copied.

```
certbot renew --cert-name CERT_NAME --force-renewal
```