How do you test that Certbot renewal will work before it fails?

Run the Certbot renew command with its dry-run flag. It exercises the renewal path against the Let's Encrypt staging server without replacing your real certificates, so you can find broken challenges, permissions or hooks. Pair it with an alert that fires if a real renewal does not happen.

What a dry run proves

A dry run uses the Let's Encrypt staging server unless you set a different one, so you do not spend production rate limits. It proves that Certbot can read its renewal configuration, answer the challenge and finish the flow. It does not prove your web server loads the new file, because nothing real is issued. Check that separately.

Steps

1. Run the test:

certbot renew --dry-run

2. Read the output for each certificate. A failed challenge usually points at a closed port, a web server rule that blocks the challenge path, or a DNS record problem. Compare with the challenge types.
3. Confirm the schedule exists. Most Certbot installs come with automatic renewal preconfigured through a scheduled task that runs the renew command periodically. Verify the task is present on your system and was not removed by an image rebuild.
4. Check the hook. Certbot runs pre and post hooks around each renewal attempt that is due, and a deploy hook after a success. Use the deploy hook to reload your web server, so the new file is served.

certbot renew --deploy-hook "systemctl reload nginx"

5. Check the result with a client, not a file listing. See reloading without downtime and the openssl checks in reading a certificate.
6. Alert on silence. Certbot 2.7.0 and later exposes the variables RENEWED_DOMAINS and FAILED_DOMAINS to post renewal hooks, which you can use to report failure.

Cautions

• Hooks run when a certificate is due, so you can run the renew command often without needless restarts.
• Do not run a forced renew every day, since it hits issuance limits fast. See rate limits.
• Options you pass to the renew command apply to every certificate it tries to renew.
• Do not edit files under the renewal directory by hand. Certbot advises testing any change with a dry run.
• A dry run with a custom server setting can cause real certificates to be issued and discarded.

Make it routine

Run the dry run after every infrastructure change, such as a new proxy, firewall rule or container image. Add an expiry check from outside your network as a second line of defense. The expiry outage checklist lists what to monitor.

Where Safeguard fits

Safeguard scans dependencies and SBOMs for known vulnerabilities, including those in the TLS and crypto libraries your projects pull in, and you can try it with the free scan at gold.safeguard.sh/scan.

Quick check

Sources

• Certbot documentation, User Guide
• Let's Encrypt, Staging Environment

Last reviewed: 19 October 2026.