If certificate is still valid for more than 30 days, after checking it, letsencrypt.sh will exit and never bother the Let's Encrypt servers; so my cron job runs every third day of every month at 02h15. It should not be a busy time for the Let's Encrypt servers.
I'd still suggest running the cron job more often (like daily). With it running once a month, there's only one chance for it to run and renew your certs, and if it encounters any problems while doing that, the next run won't be until the cert is already expired. And depending on exactly how the dates/times interact, the renewal might not run at all before the cert expires.
Here's an example of that: Suppose your cert expires on 2 Aug at 02:30. When your cron job runs at 3 Jul at 02:15, the cert still has more than 30 days left (by 15 minutes), so letsencrypt.sh doesn't renew it. Your cert expires on 2 Aug, and letsencrypt.sh doesn't run again until 3 Aug to renew it. One day without a valid cert probably isn't a terrible thing, but there's no reason for it to happen.
As you've determined, the expiration check happens locally; it never hits the LE servers to do that. So there's no real reason not to call letsencrypt.sh -c more often.
37 Replies
12269 Views