How do I test a Certbot renewal without replacing the live certificate?
Certbot’s renewal dry run tests the configured validation process using a staging CA by default and does not install the test certificate as the live certificate. It is still an active operation: challenge handling, temporary server configuration and configured hooks can run. Review those effects before testing a production service.
Before you start
- The exact certificate name from certbot certificates.
- Review of existing renewal plugins, pre/post hooks and any custom ACME server setting.
Instructions
1. Identify the certificate
Use the managed certificate name, which can differ from the first domain or contain a suffix. Targeting one lineage keeps this test focused.
sudo certbot certificatesDisplays available certificate names and covered domains.
2. Run the targeted dry run
Replace app.example.com with the exact certificate name. The default staging behaviour can be overridden by a custom ACME server setting, so verify the installation’s configuration first.
sudo certbot renew --cert-name app.example.com --dry-runTests this lineage’s renewal flow. Pre/post hooks can execute; deployment hooks are not run by default unless explicitly enabled.
3. Check the outcome and live service
Read the final result and the detailed validation error if it fails. Confirm that normal HTTPS still works and that the existing live certificate remains in service. Avoid repeated retries before understanding a failed challenge.
Check the result
- The targeted simulated renewal succeeds and the live application remains healthy.
- A separate live-endpoint check confirms the currently deployed certificate.
Troubleshooting
- HTTP-01 validation fails
- Check public DNS, port 80 reachability and the challenge path through every relevant proxy or web node.
- DNS-01 validation fails
- Review the selected DNS plugin’s credentials, zone permissions and authoritative TXT answers without exposing the credential file.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.