RymarisCerts NGINX recorded automatic walkthrough This is a genuine scripted terminal/PowerShell session on an isolated demo server. All displayed operations were executed. No production certificates, passwords, MFA, or private-key contents are included. Lab .test hostnames and explicit-root checks must be replaced with your own hostnames and normal public trust in production. Passwords were supplied privately before recording. On your server enter package passwords locally;never put them into commands,source files,or website configuration. 00:00:00.000 Chapter 1: Security: short lifetimes without repeated manual work 00:00:10.006 Chapter 2: Check the supported server and back up configuration 00:00:29.211 Chapter 3: Enroll the native client and installer once 00:00:36.819 Chapter 4: Verify the certificate actually served 00:00:49.859 Chapter 5: Check and execute the native scheduled action 00:01:13.917 Chapter 6: Confirm renewal and automatic installation 00:01:26.955 Chapter 7: Prove failure preserves the working certificate 00:01:45.104 Chapter 8: Recover and finish site checks RECORDED COMMANDS AND OUTPUT RymarisCerts | nginx automatic renewal CHAPTER 1 | Security: short lifetimes without repeated manual work Short lifetimes limit misuse after key theft or incorrect issuance. A native client replaces certificates automatically before expiry. One-time administrator setup is still required. This is a real scripted Ubuntu lab session with disposable .test names. The private ACME fixture uses one-hour certificates to demonstrate renewal. Public deployments use the normal trusted provider and actual DNS. RymarisCerts | nginx automatic renewal CHAPTER 2 | Check the supported server and back up configuration $ certbot --version certbot 2.9.0 $ nginx -v nginx version: nginx/1.24.0 (Ubuntu) $ nginx -t nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful $ cp -p "$config" "$backup" Existing sites remain in place. Keys stay outside the website folder. Use the read-only compatibility check and prove public validation on your server. RymarisCerts | nginx automatic renewal CHAPTER 3 | Enroll the native client and installer once This lab points to https://localhost:14000/dir with an explicit trusted test CA. Production uses the public provider endpoint in the written guide. $ certbot --nginx --server "$ACME" --cert-name rymariscerts-auto-nginx -d "$HOST" --key-type rsa --rsa-key-size 3072 --non-interactive --agree-tos --register-unsafely-without-email --no-redirect Saving debug log to /var/log/letsencrypt/letsencrypt.log Renewing an existing certificate for auto.nginx.rymariscerts.test Successfully received certificate. Certificate is saved at: /etc/letsencrypt/live/rymariscerts-auto-nginx/fullchain.pem Key is saved at: /etc/letsencrypt/live/rymariscerts-auto-nginx/privkey.pem This certificate expires on 2026-11-13. These files will be updated when the certificate renews. Certbot has set up a scheduled task to automatically renew this certificate in the background. Deploying certificate Successfully deployed certificate for auto.nginx.rymariscerts.test to /etc/nginx/sites-enabled/rymariscerts-auto-nginx Your existing certificate has been successfully renewed, and the new certificate has been installed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you like Certbot, please consider supporting our work by: * Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate * Donating to EFF: https://eff.org/donate-le - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - RymarisCerts | nginx automatic renewal CHAPTER 4 | Verify the certificate actually served $ curl --fail --cacert "$CA" "https://$HOST/" Automatic nginx

RymarisCerts automatic nginx certificate demo

$ peer # real TLS hostname,chain,expiry and SHA256 fingerprint subject= notAfter=Nov 13 21:22:51 2026 GMT sha256 Fingerprint=25:D6:C0:76:CA:8B:C8:C9:A9:51:98:90:05:19:76:F1:C3:35:89:0B:0A:86:95:81:4B:C3:62:66:A3:4B:67:B9 Production must pass normal public browser trust from another device. The native client keeps its account and private keys on the server. RymarisCerts | nginx automatic renewal CHAPTER 5 | Check and execute the native scheduled action $ systemctl enable --now certbot.timer $ systemctl list-timers certbot.timer --no-pager NEXT LEFT LAST PASSED UNIT ACTIVATES Sat 2026-11-14 02:15:46 U… 5h 52min Fri 2026-11-13 19:41:18 UTC - certbot.timer certbot.service 1 timers listed. Pass --all to see loaded but inactive timers, too. $ systemctl show certbot.service -p ExecStart ExecStart={ path=/usr/bin/certbot ; argv[]=/usr/bin/certbot -q renew --no-random-sleep-on-renew ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 } $ systemctl start certbot.service RymarisCerts | nginx automatic renewal CHAPTER 6 | Confirm renewal and automatic installation $ systemctl show certbot.service -p Result -p ExecMainStatus Result=success ExecMainStatus=0 $ peer # inspect the replacement currently served subject= notAfter=Nov 13 21:23:28 2026 GMT sha256 Fingerprint=A6:3F:58:B6:08:CB:F4:65:4C:56:A1:D3:EB:49:87:21:1D:AC:EC:46:2A:6F:85:BB:FC:86:33:DF:19:67:0F:EE Verified: new served fingerprint. No manual file copy or reload was required. RymarisCerts | nginx automatic renewal CHAPTER 7 | Prove failure preserves the working certificate $ cp -p "$config" "$backup" Controlled lab fault: temporarily point this one renewal at an unavailable loopback CA port. No production endpoint or other site is changed. $ systemctl start certbot.service # expected failure in this test Job for certbot.service failed because the control process exited with error code. See "systemctl status certbot.service" and "journalctl -xeu certbot.service" for details. $ systemctl show certbot.service -p Result -p ExecMainStatus Result=exit-code ExecMainStatus=1 $ peer # working certificate must remain served subject= notAfter=Nov 13 21:23:28 2026 GMT sha256 Fingerprint=A6:3F:58:B6:08:CB:F4:65:4C:56:A1:D3:EB:49:87:21:1D:AC:EC:46:2A:6F:85:BB:FC:86:33:DF:19:67:0F:EE A reported failure needs monitoring and investigation before expiry. RymarisCerts | nginx automatic renewal CHAPTER 8 | Recover and finish site checks $ cp -p "$backup" "$config" $ systemctl start certbot.service $ peer # recovered scheduled renewal is installed subject= notAfter=Nov 13 21:24:12 2026 GMT sha256 Fingerprint=70:6A:EF:3E:C3:84:22:F5:01:34:67:68:45:DD:C0:37:A6:26:FC:25:4E:01:16:55:45:91:13:0B:2E:08:49:2B $ curl --fail --cacert "$CA" "https://$HOST/" Automatic nginx

RymarisCerts automatic nginx certificate demo

$ curl --fail http://127.0.0.1:8080/; curl --fail http://127.0.0.1:8081/ RymarisCerts apache control

RymarisCerts apache control site

RymarisCerts nginx control

RymarisCerts nginx control site

Both control sites work. Short-lived certificates are practical with verified automatic replacement. Unsupported setups need review or the manual fallback. The disposable lab timer is stopped after filming;production timers stay enabled. LAB HELPER NOTE Peer/fingerprint validate the live HTTPS name and chain using the explicit private lab root and report only public certificate details. The scheduled helper executes the real native renewal action. The temporary loopback connectivity fault is confined to this disposable lab. Production uses normal public trust and the provider endpoint in the written guide;never install the lab root or copy its endpoint to production. Private client account and certificate keys stay on the server and are never printed.