Cron job to auto renew Letsencrypt SSL certificate using Lego in Lightsail

To set up a cron job for automatically renewing your Let's Encrypt SSL certificate using Lego on your Lightsail WordPress instance, you can follow these steps:

1. Open the crontab editor for the bitnami user by running the following command:

   sudo crontab -e -u bitnami

2. In the crontab file, add the following line:

   0 0 * * * sudo /opt/bitnami/letsencrypt/lego --path /opt/bitnami/letsencrypt --email="YOUR-EMAIL-ADDRESS" --domains="YOUR-DOMAIN" --domains="*.YOUR-DOMAIN" --dns YOUR-DNS-PROVIDER renew >> /var/log/letsencrypt.log 2>&1 && sudo /opt/bitnami/apache/bin/httpd -f /opt/bitnami/apache/conf/httpd.conf -k graceful

   Make sure to replace "YOUR-EMAIL-ADDRESS", "YOUR-DOMAIN", and "YOUR-DNS-PROVIDER" with your actual values.

3. Save and exit the crontab editor.

This cron job will run daily at midnight (0 0 * * *) and attempt to renew the certificate. The Lego tool will automatically check if renewal is necessary (certificates are valid for 90 days and can be renewed 30 days before expiry). If a renewal is performed, it will gracefully restart the Apache web server to apply the new certificate.

The command logs its output to /var/log/letsencrypt.log, which you can check for any issues or confirmation of successful renewals.

Remember to ensure that your DNS provider is supported by Lego and that you have the necessary credentials set up for DNS challenge authentication.

After setting up the cron job, it's a good practice to also configure HTTPS redirection for your WordPress site to ensure all traffic uses the secure connection.
Sources
Install a wildcard SSL certificate in Lightsail Bitnami | AWS re:Post

You can refer to Bitnami documentation on using Lego client, i.e. Generate and Install a Let's Encrypt SSL Certificate for a Bitnami Application, Step 5: Renew the Let’s Encrypt certificate. It provides instructions for cron script creation.

So I ended up creating a shell script (see below) and this is my crontab entry:

10 01 1 */3 * /opt/bitnami/scripts/letsencryptlego.sh

/opt/bitnami/ctlscript.sh stop
sleep 60
/opt/bitnami/letsencrypt/lego --tls --email="YOUR EMAIL ADDRESS" --domains="YOUR DOMAIN(S)" --path="/opt/bitnami/letsencrypt" renew --days 90
sleep 300
sudo /opt/bitnami/ctlscript.sh start

I'll try to remember to follow up and let you guys know if it worked in 90 days.

Hi there,

For the simplest and most reliable way to manage SSL certificates on your Lightsail WordPress instance, I strongly recommend using Lightsail's built-in SSL setup: https://docs.aws.amazon.com/lightsail/latest/userguide/amazon-lightsail-quick-start-guide-wordpress.html#quick-start-guide-set-up-wordpress-instance-website

This official method automatically handles certificate renewal and is fully supported by AWS, making it much more maintainable than custom solutions like Lego.

If you need more control over your SSL configuration, Bitnami also provides comprehensive documentation for managing Let's Encrypt certificates: https://docs.bitnami.com/aws/how-to/generate-install-lets-encrypt-ssl/

Let me know if you need help with setting up either of these approaches!