Automatic Renewals - Networking4all ACME Documentation

ACME clients typically handle certificate renewals automatically by setting up scheduled tasks, cron jobs, or system services that periodically check for certificates that need renewal.

Checking if automatic renewals are configured

After installing an ACME client and obtaining your first certificate, it's important to verify that automatic renewals have been properly configured. Most ACME clients will automatically set up the necessary scheduling mechanism during installation or after the first successful certificate issuance. Depending on the client, this could be a cron job (Linux/Unix), a systemd timer (modern Linux distributions), a scheduled task (Windows), or a background service.

To verify your automatic renewal setup, check the table below for your ACME client and follow the appropriate verification method:

Client	Renewal Method	Setup Type	How to Verify
Certbot	systemd timer or cron (older systems)	Automatic	Run `systemctl list-timers` and look for `certbot.timer` or check `/etc/cron.d/certbot`
acme.sh	cron	Automatic	Check `crontab -l` for an entry containing `acme.sh --cron`
simple-acme	Windows Scheduled Task	Automatic	Check Task Scheduler (`taskschd.msc`) for tasks created by simple-acme
cert-manager	Kubernetes controller	Automatic	Runs as a pod; check with `kubectl get pods -n cert-manager`
Certify	Windows service	Automatic	In Services (`services.msc`) ensure the Certify service is running
KeyVault-Acmebot	Azure Functions timer trigger	Automatic	In the Azure Portal > your Function App > Overview > Functions look for `RenewCertificates_timer`
dehydrated	systemd timer or cron	Manual	Requires manual creation of systemd/cron entry calling `dehydrated -c` (this is not required when acquired through EPEL)
Posh-ACME	Windows Scheduled Task	Manual	Requires manual creation of scheduled task calling `Submit-Renewal -AllOrders`

Renewal threshold

Most ACME clients will automatically renew certificates when a certificate nears the end of its lifetime. The default settings, are not always recommended as they will attempt to renew as early as 3 months before a 199 day certificate expires. Certificates for which renewal attempts come too early will be reissued instead. While this is cost-free, your certificates will be reissued unnecessarily and your client may call deployment hooks as well if you have set these up.

Make sure your client supports the ARI extension and that it is set up to utilize it properly.

Preventing early renewals and the ARI extension

Make sure you are using Certbot version 4.1.1 or higher.
These versions have support for the ARI extension and will automatically pick the correct date for renewal as suggested by our server.

Make sure you are using acme.sh version 3.1.4 or higher.
These versions have support for the ARI extension and will automatically pick the correct date for renewal as suggested by our server.

By default simple-acme considers a certificate ready for renewal when 55 days have passed. This means that for a 199-day-certificate your certificates will be reissued ~3 times before an actual renewal takes place due to early renewal attempts by simple-acme.

simple-acme supports the ARI extension which means it will try to honor the suggested renewal times made by our ACME server.
By setting the ScheduledTask.RenewalDays in your settings once you can ensure that your renewals automatically happen at the perfect moment based on our server suggestions.

To configure renewal to only happen within our suggested renewal windows do the following:
Locate the global configuration file settings.json typically found at %PROGRAMDATA%\simple-acme\settings.json (e.g. C:\ProgramData\simple-acme\settings.json)
Edit settings.json and set ScheduledTask.RenewalDays to 199 (max lifetime) and ScheduledTask.RenewalMinimumValidDays to 16 (our renewal threshold)
Note that setting RenewalMinimumValidDays is optional and only used as a fallback, simple-acme will use the dates suggested by our ACME server from this point on.

settings.json

{
  "ScheduledTask": {
    "RenewalDays": 199,
    "RenewalMinimumValidDays": 16
  }
}