July 2026

Let’s Encrypt renewals that never surprise you

Certificates that expire at 3am are almost always caused by a renewal method that worked once and then quietly broke.

Prefer webroot

Standalone mode needs port 80 free. As soon as a web server is installed, renewals fail. Webroot mode keeps working alongside it.

Test the renewal

Run a dry run after every server change, and add a deploy hook so services reload the new certificate automatically.