https://stackonward.com/tags/lets-encrypt/Recent content in Let's Encrypt on StackOnwardHugoen-USFri, 11 Sep 2026 05:05:00 +0800https://stackonward.com/posts/https-certificate-automatic-renewal/Fri, 11 Sep 2026 05:05:00 +0800https://stackonward.com/posts/https-certificate-automatic-renewal/<p>Automatic HTTPS certificate renewal in Caddy is not a cron job. Caddy obtains a certificate, serves HTTPS, redirects HTTP, and renews in the background when the hostname, public DNS, ACME challenge path, and certificate storage all work. A running Caddy process does not prove the next ACME attempt will succeed.</p> <figure> <img src="https://stackonward.com/images/posts/https-certificate-automatic-renewal/en/acme-renewal-flow.svg" alt="Flow from Caddy reading a hostname, completing ACME validation, storing the certificate, renewing in the background, and checking TLS from outside" loading="lazy" decoding="async"> <figcaption>After issuance, the certificate, private key, and ACME account state are written to the data directory. Background renewal uses the same challenge path.</figcaption> </figure> <h2 id="automatic-https-certificate-renewal-only-starts-when-these-conditions-hold">Automatic HTTPS certificate renewal only starts when these conditions hold</h2> <p><a href="https://caddyserver.com/docs/automatic-https" target="_blank" rel="noopener">Caddy&rsquo;s Automatic HTTPS documentation<span class="sr-only">(opens in a new tab)</span></a> requires all of the following at once:</p>