What it is
Certbot is a free, open source tool from the Electronic Frontier Foundation that gets TLS certificates from Let's Encrypt and installs them on a web server. It proves you control a domain using the ACME protocol, then writes the certificate and can configure Apache or nginx to use it. It runs on Linux servers and is written in Python.
Let's Encrypt certificates are valid for 90 days, so renewal has to be automatic. Certbot sets up a scheduled renewal that runs in the background and reloads the web server when a new certificate arrives. Done right, HTTPS is something you set up once and stop thinking about. Certbot can also run a dry run of renewal to prove it will work.
How I use it
- Let's Encrypt provides TLS for every host on the stucco company's and the rental company's websites and job app.
- Lend Pilot's origin runs nginx with Let's Encrypt TLS, behind CloudFront.
- Route 53 carries CAA records naming the only authorities allowed to issue certificates for the company domains.
- Apache serves with security headers, no directory listings and no version banners.
Certbot is the right tool when a server you run directly, rather than a managed edge service, needs HTTPS. I reach for it on the origin servers, and use AWS Certificate Manager where CloudFront is in front. Either way, every host gets TLS and nothing depends on someone remembering a renewal date.
Questions
Do you set up HTTPS for the sites you run?
Yes. Every host I run has TLS, through Let's Encrypt on the origin servers and AWS Certificate Manager where CloudFront sits in front.
What happens when a Let's Encrypt certificate expires?
Certbot renews certificates automatically before they expire, so nobody has to remember the date.