Renew an expired SSL certificate with certbot

When the certificate of your panel or a Wings node expires, browsers show a security warning and the panel can no longer reach the node (the console stays empty, the node shows as offline). This guide is for certificates from Let's Encrypt made with certbot, as in the Pterodactyl installation guide.

Check which certificates you have and when they expire#

sudo certbot certificates

For each certificate you see the domains, the Expiry Date and the paths of the files (/etc/letsencrypt/live/<domain>/fullchain.pem and privkey.pem).

Renew the certificate#

1. Try a renewal:

   Copier

   sudo certbot renew
   

   certbot renews only the certificates that are close to their expiry date, and skips the rest.

2. If it fails because port 80 is in use, the certificate was probably made with the standalone method. Either renew it with the plugin of your web server:

   Copier

   # NGINX
   sudo certbot certonly --nginx -d panel.example.com
   # Apache
   sudo certbot certonly --apache -d panel.example.com
   

   or stop the web server for a moment, renew, and start it again:

   Copier

   sudo systemctl stop nginx
   sudo certbot renew
   sudo systemctl start nginx
   

   Replace panel.example.com with your domain. The plugin needs the package python3-certbot-nginx or python3-certbot-apache.

3. If renewal fails because Let's Encrypt cannot reach your server, check that port 80 is open in your firewall and that the domain's DNS points to this server. If the domain goes through a proxy such as Cloudflare, see the troubleshooting section of the Pterodactyl documentation.

Restart what uses the certificate#

A web server reloaded with the plugin picks up the new certificate by itself. In other cases, restart the services that use it:

# The panel's web server
sudo systemctl reload nginx

# On a node: Wings may keep the old certificate until it restarts
sudo systemctl restart wings

Restarting Wings does not stop your game servers.

Then check in the browser that the warning is gone, and in the admin area under Nodes that every node shows a green heart again.

Make renewal work by itself#

Certificates from Let's Encrypt are valid for a short time and must be renewed regularly. Most installations of certbot come with an automatic renewal.

1. Check that a timer or cron job for certbot exists:

   Copier

   systemctl list-timers | grep -i certbot
   sudo grep -r certbot /etc/cron.d /var/spool/cron/crontabs 2>/dev/null
   

2. Test the renewal without changing anything:

   Copier

   sudo certbot renew --dry-run
   

   If this fails, the automatic renewal fails too. Fix the cause shown in the output.

3. Make sure Wings and the web server restart after a renewal. Put a deploy hook in /etc/letsencrypt/renewal-hooks/deploy/. certbot runs the scripts there only after a certificate was actually renewed:

   Copier

   sudo nano /etc/letsencrypt/renewal-hooks/deploy/restart-services.sh
   

   Copier

   #!/bin/sh
   systemctl reload nginx
   # Only on a node with Wings:
   systemctl restart wings
   

   Make it executable:

   Copier

   sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/restart-services.sh
   

   Remove the line for a service that does not run on that server.

Avoid hitting the limits of Let's Encrypt#

Do not use --force-renewal in a scheduled task. It renews every time, whatever the expiry date, and you soon hit the rate limits of Let's Encrypt. Use --dry-run to test.

For the other settings of a panel, see secure your Pterodactyl Panel.