certbot

Obtain and renew Let’s Encrypt certificates

medium risk

interactive breakdown — edit the command and press Explain
$ 
⚠ Risks & cautions
Safer / dry-run alternatives
certbot renew --dry-runTest with the staging server
What it does

ACME client that issues and renews TLS certificates.

Common flags
FlagMeaning
certonlyObtain only
renewRenew all due certs
--dry-run --dry-runTest against the staging server
--force-renewal --force-renewalForce renewal⚠ Can trigger rate limits.
Examples
certbot renew --dry-runTest renewal · explain & risk-check →
certbot certonly --nginx -d example.comIssue a certificate · explain & risk-check →
Related
openssl nginx
Open the full explainer →More in Users, Permissions & Security

Reference text is hand-written and may be incomplete — check man certbot for your version. Test destructive commands on a non-production system first.