Let’s Encrypt and Automated Renewal: 90-Day Certificates Without the Stress

Let’s Encrypt issues free, automated certificates — with a deliberate 90-day lifetime. The short validity is not a limitation to work around but a design decision that forces renewal to become routine, which in turn keeps compromised keys and stale configurations short-lived.

Automation with ACME

Clients such as certbot or acme.sh renew automatically, typically at the 60-day mark. The renewal itself depends on a challenge — proof that you control the domain:

• HTTP-01: the CA fetches a token file from port 80 of your domain. Simple and common, but if a CDN or proxy sits in front of the server, the challenge path must pass through to the origin, or renewals fail invisibly.
• DNS-01: the CA checks a temporary TXT record on your zone. This is the only option for wildcard certificates, and it works without any inbound HTTP access — at the cost of needing API access to your DNS provider.

certbot renew --dry-run

Run the dry-run after any infrastructure change: it exercises the whole renewal path without touching the live certificate.

Guarding the guard

Automation eventually breaks — the DNS provider changes its API, the CDN rule blocks /.well-known/acme-challenge/, the cron daemon was disabled during a migration. Because the failure is silent until day 90, an independent check is the standard safety net: alert when a certificate has fewer than 14 days left. If you already run uptime monitors, enable certificate-expiry alerts on the same monitor; the WhoDNS monitoring module warns on remaining validity alongside availability, so a broken renewal surfaces weeks before the browser warning does.

🔗 Related tool: Check certificate expiry for your site