{"id":50932436,"url":"https://github.com/shuvo-halder/certbot-auto-renew","last_synced_at":"2026-06-17T05:31:40.766Z","repository":{"id":351775088,"uuid":"1212435133","full_name":"shuvo-halder/certbot-auto-renew","owner":"shuvo-halder","description":"Automated SSL certificate renewal system using Certbot, designed for production Linux environments.","archived":false,"fork":false,"pushed_at":"2026-04-16T11:43:55.000Z","size":11,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-16T13:31:31.762Z","etag":null,"topics":["apache","automation","bash","certbot","devops","devops-tools","firewall","letsencrypt","letsencrypt-certificates","linux","nginx","ssl"],"latest_commit_sha":null,"homepage":"https://s2deals.org","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/shuvo-halder.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-16T11:27:50.000Z","updated_at":"2026-04-16T12:08:31.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/shuvo-halder/certbot-auto-renew","commit_stats":null,"previous_names":["shuvo-halder/certbot-auto-renew"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/shuvo-halder/certbot-auto-renew","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuvo-halder%2Fcertbot-auto-renew","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuvo-halder%2Fcertbot-auto-renew/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuvo-halder%2Fcertbot-auto-renew/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuvo-halder%2Fcertbot-auto-renew/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/shuvo-halder","download_url":"https://codeload.github.com/shuvo-halder/certbot-auto-renew/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/shuvo-halder%2Fcertbot-auto-renew/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34435978,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-17T02:00:05.408Z","response_time":127,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apache","automation","bash","certbot","devops","devops-tools","firewall","letsencrypt","letsencrypt-certificates","linux","nginx","ssl"],"created_at":"2026-06-17T05:31:39.882Z","updated_at":"2026-06-17T05:31:40.759Z","avatar_url":"https://github.com/shuvo-halder.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n```markdown\n# 🔐 Certbot Auto Renewal Script \n\nAutomated SSL certificate renewal system using **Certbot**, designed for production Linux environments.\n\nThis script handles:\n\n- OS detection (Ubuntu, Debian, CentOS, RHEL, etc.)\n- Web server detection (Nginx / Apache)\n- Firewall handling (UFW / firewalld / none)\n- Safe SSL renewal for multiple domains\n- Temporary firewall rule management\n- Service reload only when needed\n- Logging and error handling\n- Cron-based automation\n\n📦 GitHub Repository:  \n👉 https://github.com/shuvo-halder/certbot-auto-renew\n\n---\n\n## 📦 Features\n\n✅ Fully automated SSL renewal  \n✅ Multi-domain \u0026 multi-cert support  \n✅ Idempotent (safe to run multiple times)  \n✅ No permanent firewall changes  \n✅ Minimal downtime (no unnecessary restarts)  \n✅ Production-safe logging  \n\n---\n\n## 📁 File Structure\n\n```\n\nssl-certbot/\n├── certbot-auto-renew.sh\n└── README.md\n\n````\n\n---\n\n## ⚙️ Requirements\n\n- Linux server (Ubuntu / Debian / CentOS / RHEL / Rocky / AlmaLinux)\n- Root or sudo access\n- Certbot installed  \n  👉 https://certbot.eff.org\n- One of:\n  - Nginx\n  - Apache\n- Optional:\n  - UFW\n  - firewalld\n\n---\n\n## 🚀 Installation\n\n### 1. Clone Repository\n\n```bash\ngit clone https://github.com/shuvo-halder/certbot-auto-renew.git\ncd certbot-auto-renew\n````\n\n---\n\n### 2. Install Script\n\n```bash\nsudo install -m 0755 certbot-auto-renew.sh /usr/local/bin/certbot-auto-renew.sh\n```\n\n---\n\n### 3. Create Log File\n\n```bash\nsudo touch /var/log/certbot-auto-renew.log\nsudo chmod 640 /var/log/certbot-auto-renew.log\n```\n\n---\n\n## 🔍 How It Works\n\n### Execution Flow\n\n1. Detect OS (Ubuntu / Debian / RHEL family)\n2. Detect running web server:\n\n   * nginx\n   * apache2 / httpd\n3. Detect firewall:\n\n   * UFW\n   * firewalld\n   * none\n4. Read all certificates from:\n\n   ```\n   /etc/letsencrypt/renewal/\n   ```\n5. For each certificate:\n\n   * Open required ports (80, 443) temporarily\n   * Run renewal:\n\n     ```\n     certbot renew --cert-name \u003ccert\u003e\n     ```\n   * Close firewall rules safely\n6. If certificate changed:\n\n   * Reload web server\n7. Write logs to:\n\n   ```\n   /var/log/certbot-auto-renew.log\n   ```\n\n---\n\n## 🔥 Firewall Handling\n\n### UFW\n\n* Detects active state\n* Adds rule only if missing\n* Removes only rules added by script\n\n---\n\n### firewalld\n\n* Detects active zones\n* Adds **runtime-only rules**\n* No permanent changes\n* Automatically cleaned after run\n\n---\n\n### No Firewall\n\n* Script skips firewall steps\n\n---\n\n## 🌐 Web Server Handling\n\n| Server | Action                               |\n| ------ | ------------------------------------ |\n| Nginx  | `systemctl reload nginx`             |\n| Apache | `systemctl reload apache2` / `httpd` |\n\n✔ Reload only happens if certificate is updated\n\n---\n\n## 📜 Logging\n\nLog file:\n\n```\n/var/log/certbot-auto-renew.log\n```\n\nExample:\n\n```\n[2026-04-16 03:00:01] Renewing certificate: example.com\n[2026-04-16 03:00:05] Certificate updated; reloading nginx\n[2026-04-16 03:00:06] Completed successfully.\n```\n\n---\n\n## ⏰ Cron Setup\n\n### Daily (Recommended)\n\n```bash\nsudo crontab -e\n```\n\nAdd:\n\n```\n0 3 * * * /usr/local/bin/certbot-auto-renew.sh\n```\n\n---\n\n### Twice Daily (High Availability)\n\n```\n0 3,15 * * * /usr/local/bin/certbot-auto-renew.sh\n```\n\n---\n\n## 🧪 Manual Test\n\n```bash\nsudo /usr/local/bin/certbot-auto-renew.sh\n```\n\nCheck logs:\n\n```bash\ntail -f /var/log/certbot-auto-renew.log\n```\n\n---\n\n## ⚠️ Important Notes\n\n* Renewal runs only when certificate is near expiry\n* No forced renewals\n* No permanent firewall changes\n* Safe to run multiple times\n* Lock mechanism prevents duplicate runs\n* Requires root access\n\n---\n\n## 🛠 Troubleshooting\n\n### Check Certificates\n\n```bash\ncertbot certificates\n```\n\n---\n\n### Dry Run\n\n```bash\ncertbot renew --dry-run\n```\n\n---\n\n### Firewall Debug\n\n#### UFW\n\n```bash\nufw status\n```\n\n#### firewalld\n\n```bash\nfirewall-cmd --list-all\n```\n\n---\n\n### Service Check\n\n```bash\nsystemctl status nginx\nsystemctl status apache2\nsystemctl status httpd\n```\n\n---\n\n## 🔒 Security Considerations\n\n* Strict file permissions (`umask 027`)\n* No sensitive data exposure\n* Temporary firewall rules only\n* No service restarts (reload only)\n\n---\n\n## 📌 Best Practices\n\n* Test with `--dry-run` before production\n* Monitor logs regularly\n* Keep Certbot updated\n* Backup `/etc/letsencrypt/`\n\n---\n\n## 🤝 Contributing\n\nFeel free to fork and improve:\n\n👉 [https://github.com/shuvo-halder/certbot-auto-renew](https://github.com/shuvo-halder/certbot-auto-renew)\n\n---\n\n## 📄 License\n\nMIT License (recommended — update if different)\n\n---\n\n## 👨‍💻 Author\n\n**Shuvo Halder**\nSystem Engineer\n\nGitHub: [https://github.com/shuvo-halder](https://github.com/shuvo-halder)\n\n---\n\n## ✅ Summary\n\nThis project provides:\n\n* 🔁 Automated SSL lifecycle management\n* 🔥 Smart firewall handling\n* ⚙️ Multi-environment compatibility\n* 🚀 Production-ready automation\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshuvo-halder%2Fcertbot-auto-renew","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fshuvo-halder%2Fcertbot-auto-renew","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fshuvo-halder%2Fcertbot-auto-renew/lists"}