How do I check which certificates Certbot manages and whether renewal is scheduled?
Certbot can list the certificate lineages it manages, including names and paths. Renewal scheduling depends on how Certbot was installed: distribution packages, snap installations and other methods can use different unit or job names. Verify the existing schedule before adding another one.
Before you start
- Permission to inspect Certbot state and the service scheduler.
- Knowledge of the Certbot installation method.
Instructions
1. Read certificate inventory
Identify the certificate name, covered domains and expiry date. A certificate name can include a suffix, so do not assume it exactly equals the domain.
sudo certbot certificatesLists Certbot-managed certificates without requesting a new certificate.
2. Inspect scheduled timers
Look for the renewal mechanism corresponding to the installation method. If the system uses cron instead, inspect the relevant system or service-account schedule through its normal administrative tools.
systemctl list-timers --all --no-pagerLists systemd timers; the absence of a timer does not rule out a cron-based renewal job.
3. Review execution evidence
Check the actual renewal service’s recent journal or configured Certbot log. A timer being scheduled does not prove its last run succeeded, nor that the web service loaded a renewed certificate.
Check the result
- The intended certificate is managed, an active renewal schedule exists and recent execution evidence is successful.
- The live endpoint’s certificate expiry agrees with the deployed certificate.
Troubleshooting
- No certificates appear
- Confirm that Certbot is the actual ACME client and that you are inspecting the correct installation or configuration directory.
- A timer runs but renewal fails
- Read its specific validation error and test that one certificate’s renewal process before changing the schedule.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.