← Back to Blog

How to Set Up Automatic SSL Renewal on a VPS (2026)

Published May 4, 2026 · 4 min read · Galaxy Cloud Solutions

Let's Encrypt certificates are free and they work great, but they expire every 90 days. Forgetting to renew is the kind of thing that happens at 3am when you least expect it — your site goes down, your browser shows a big red warning, and your users panic. Automatic renewal costs nothing to set up and means you never have to think about it again.

⚡ VPS from $5/mo — Use code LAUNCH2026 for 50% off

How Certbot Renewal Works

Certbot installs a renewal configuration for each certificate it creates. The certbot renew command checks all your certificates and renews any that are within 30 days of expiry. Running this command twice a day via cron means your certificates renew automatically before they expire.

Step 1: Verify Certbot Is Installed

certbot --version

If it is not installed:

sudo apt install -y certbot python3-certbot-nginx

Step 2: Test the Renewal Process

sudo certbot renew --dry-run

This simulates the renewal without actually doing anything. If it says "Congratulations, all renewals succeeded" you are good. If it throws errors, fix them before setting up the cron job.

Step 3: Check the Automatic Timer

On Ubuntu 24.04, Certbot installs a systemd timer automatically:

sudo systemctl status certbot.timer

If it shows as active and running, automatic renewal is already configured and you are done. This is the case on most modern Ubuntu installs.

Step 4: If the Timer Is Not Running, Set Up a Cron Job

sudo crontab -e

Add this line:

0 3,15 * * * certbot renew --quiet --deploy-hook "systemctl reload nginx"

This runs at 3am and 3pm every day. The --quiet flag suppresses output when nothing needs renewing. The --deploy-hook reloads Nginx after a successful renewal so the new certificate takes effect immediately.

Step 5: Verify Your Certificates

sudo certbot certificates

This shows all your certificates, their domains, expiry dates, and renewal configuration. Check that the expiry dates are in the future and the certificate paths are correct.

What to Do If a Certificate Expires

If a certificate expires despite your setup (it happens), renew it manually:

sudo certbot renew --force-renewal -d yourdomain.com
sudo systemctl reload nginx