RymarisSet up once. Renew automatically.
Automatic renewal for Nginx
Set up a native certificate client on your server once. On a compatible configuration, it obtains replacements and installs them before expiry. You should not have to download and reinstall a certificate every few months.
Why shorter certificates improve security
A shorter lifetime limits the window in which a stolen private key or incorrectly issued certificate can be misused. Automatic renewal makes frequent replacement practical and reduces repeated manual key handling. It does not repair a compromised server: exposed keys still need prompt revocation/replacement and investigation.
Your annual RymarisCerts plan covers management and guidance across renewals. It does not make one certificate valid for a year. Use the actual expiry and renewal schedule, not your billing anniversary. Read the certificate authority's security rationale.
Compatibility comes first
Lab configuration: Ubuntu 24.04 / Nginx 1.24 · Certbot 2.9 with Nginx installer.
- You need administrator access, the intended site's configuration and a protected rollback.
- Public DNS and HTTP port 80 must reach the correct server for this HTTP-01 path. Check IPv6 and any proxy/CDN too.
- Managed hosting, wildcard DNS/API automation, other versions and unusual network layouts require a separate compatibility check. This is not a guarantee for every server.
Download the read-only compatibility check. The check reports local prerequisites; only real validation and a verified installation prove setup succeeded.
This lab configuration passed initial enrollment, the native scheduled renewal action, verification of the changed served certificate, and controlled failure/recovery checks. Disposable test certificates were used. Your own public DNS, trust and installation must still pass.
Watch automatic renewal and installation
Actual scripted lab session, silent with English captions. Pause or use full screen to read commands. The lab uses a private ACME test server and short test lifetimes to demonstrate real replacement. Production uses your chosen publicly trusted provider; never copy a lab root or bypass TLS warnings.
Read the automatic-renewal transcript
Jump to a chapter
Chapters are ready when video metadata loads.
One-time setup
Confirm root/sudo access, a conventional Ubuntu 24.04 Nginx 1.24 site and its exact hostnames. Run the compatibility check and back up the server block. Managed hosting, containers, proxies and other distributions may need a different integration.
Install Certbot and its Nginx installer from distribution packages. Check versions and that the intended server_name already serves the correct HTTP website.
Run the Nginx setup command with your actual hostnames and review the provider terms/contact address. Certbot validates, obtains the certificate and configures the intended Nginx server. Preserve other server blocks and application settings.
Complete DNS/HTTP validation and configuration checks. Public IPv4/IPv6 and port 80 must reach the intended server for HTTP-01. Wildcards need a separate DNS API integration and are outside this verified path.
Check every public HTTPS name from another device without bypassing warnings: intended page, trust chain, SAN names, expiry and served fingerprint. Confirm unrelated sites still work and keep private keys outside the web root.
Enable/check certbot.timer and run certbot renew --dry-run. The dry run exercises staging renewal and does not replace the live production certificate. Keep the saved Nginx installer; certonly downloads without an installer/deploy hook do not by themselves reload a server.
When due, the native scheduled client renews and its saved Nginx installer installs/reloads the certificate. Verify the certificate actually served after renewal and arrange monitoring for failed tasks or approaching expiry.
Maintain supported software and recheck after DNS, firewall, configuration or permission changes. If automation fails, preserve the working certificate while investigating and use the manual fallback or request a separate quote.
Commands for your own supported server
Replace example.com with your actual hostname. Add www or other names only when their DNS and site bindings are ready. Keep an existing backup and review the provider's terms when prompted.
sudo apt update sudo apt install certbot python3-certbot-nginx # Use only hostnames already configured for this site. sudo certbot --nginx --server https://acme-v02.api.letsencrypt.org/directory --key-type rsa --rsa-key-size 3072 -d example.com sudo systemctl enable --now certbot.timer sudo certbot renew --dry-run systemctl list-timers certbot.timer # From another device: curl -I https://example.com/
Where your private key lives
The native client talks directly to the certificate authority and keeps its renewal credentials and private keys on your server. RymarisCerts does not need your server password or DNS API credentials for this HTTP-01 path. Back up that server's client configuration securely.
Your dashboard can check and save the public certificate your website serves. It cannot export the private key of a certificate created only by your native client. Protected PFX/PEM downloads remain available for certificates issued through the portal's manual workflow.
If automation fails
Check the native task/timer, client logs, DNS, HTTP challenge path, permissions and configuration tests before expiry. A successful order or scheduler launch alone does not prove installation. Verify the live certificate after recovery. Keep the working configuration while investigating and avoid repeatedly forcing public orders.
Manual Nginx installation and format fallback · Request separately quoted setup help · Renewal checklist