Fixed. Automating this was one of the things I planned to do but then we went to Corsair. For some reason it won't automate.
/etc/cron.daily/certbot-renew Code: certbot renew --rsa-key-size 4096 --webroot -w /var/www/letsencrypt --post-hook "systemctl restart nginx" 2>&1 Set the permissions to the same as your files being served Code: sudo mkdir -p /var/www/letsencrypt/.well-known && sudo chown -Rf nginx: /var/www/letsencrypt nginx config (I keep this in a snippet file that I then import into every domain) Code: location ^~ /.well-known/acme-challenge/ { default_type "text/plain"; root /var/www/letsencrypt; } You can then test with a dry-run Code: sudo certbot renew --dry-run --rsa-key-size 4096 --webroot -w /var/www/letsencrypt --post-hook "systemctl restart nginx" 2>&1
