bncert does not automatically renew your certificate - Lightsail docs incorrect

Question

The documentation for Lightsail under the How-to, "Enabling HTTPS on your WordPress instance in Amazon Lightsail" specifically says the following:

"However, Certbot does not automatically renew your certificate like the bncert tool."

I used the bncert tool about a year ago, and recently received emails from "Let's Encrypt" saying that the certificate was going to expire. I thought this might be an error, because the documentation above made clear that the bncert tool would automatically renew it. The certificate expired.

If the bncert tool does not automatically renew the certificate, then the above documentation is not merely unclear, it makes an outright false claim.

Does it need to be corrected, or did I miss something?

Accepted Answer

Hi,

Let's Encrypt certificates are only valid for 90 days. The bncert tool helps setup auto-renewal for the certificate.

Since you setup the certificate and bncert about a year ago and only recently received the expiration email - it sounds like something has changed or been broken in the setup since (i.e. renewal was working correctly earlier)

Does the email contain some information about any renewal failures ? Else your actual instance must have logs from the bitnami tool on certificate renewal attempts and what went wrong.

You may also find some helpful information here - https://repost.aws/knowledge-center/lightsail-bitnami-renew-ssl-certificate

Answer

Hello.

Looking at the document below, it seems that certificates are updated every 80 days.  
In other words, the fact that a certificate issued one year ago was usable until recently means that it was possible to renew it until now.  
Therefore, for some reason, the renewal was not successful and the certificate has recently expired.  
https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-enabling-https-on-wordpress?trk=d7920dcb-23ef-4a3f-9619-088dfdc45d2e&sc_channel=ta  
> The bncert tool will perform an automatic renewal of your certificate every 80 days before it expires. Repeat the above steps if you wish to use additional domains and subdomains with your instance, and you want to enable HTTPS for those domains.

I thought that there would be no problem if I executed the following command and updated it again.  
```
sudo /opt/bitnami/bncert-tool
```

bncert does not automatically renew your certificate - Lightsail docs incorrect

Relevant content