# How to renew Let's Encrypt?
**URL:** https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183
**Category:** Support
**Created:** [September 1, 2017, 1:41am UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183 "2017-09-01T01:41:30Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@Yomi\_Tsuku](https://meta.discourse.org/u/Yomi_Tsuku)
#### Post date: [September 1, 2017, 1:41am UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/1 "2017-09-01T01:41:30Z")
I got the warning email but don’t know how to renew it.
---
### Author:  [@robbyoconnor](https://meta.discourse.org/u/robbyoconnor)
#### Post date: [September 1, 2017, 2:02am UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/3 "2017-09-01T02:02:45Z")
There should be a cronjob that does it automatically for you.
Also:
> [@Set up HTTPS support with Let's Encrypt](https://meta.discourse.org/t/setting-up-lets-encrypt/40709):
>
> bookmark This is a guide for enabling HTTPS on an existing Discourse installation using Let’s Encrypt. It assumes prior installation without HTTPS enabled. person_raising_hand Required user level: System Administrator exclamation This guide is only for existing installs where HTTPS is not enabled. Following the [official setup guide](https://github.com/discourse/discourse/blob/main/docs/INSTALL-cloud.md) automatically enables HTTPS by default. So you’d like to add https to your Discourse absolutely free, courtesy of our friends at [Let’s Encrypt?](https://letsencrypt.org/)bell I…
---
### Author:  [@gigperformer](https://meta.discourse.org/u/gigperformer)
#### Post date: [September 25, 2018, 9:35pm UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/4 "2018-09-25T21:35:50Z")
Our forum is down (i.e. blocked by Safari) due to this certificate having expired today. What’s the cron job? Can I run it manually?
---
### Author:  [@robbyoconnor](https://meta.discourse.org/u/robbyoconnor)
#### Post date: [November 20, 2018, 11:37pm UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/5 "2018-11-20T23:37:45Z")
It should happen automatically for you if you are running via Docker. I have never needed to manually renew mine.
---
### Author:  [@gigperformer](https://meta.discourse.org/u/gigperformer)
#### Post date: [November 21, 2018, 12:29am UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/6 "2018-11-21T00:29:57Z")
Thanks, Robby. The problem was due to the fact that I was blocking port 80 (seemed like a good idea from a security perspective) and didn’t realize that LetsEncrypt used port 80
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [November 21, 2018, 5:19pm UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/7 "2018-11-21T17:19:25Z")
Yep - outright blocking port 80 is usually a bad idea:
- people trying to get to the http side won’t be able to connect and thus won’t get the redirect to https
- let’s encrypt uses http to verify by necessity
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [November 21, 2018, 5:23pm UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/8 "2018-11-21T17:23:42Z")
Let’s Encrypt needs to expose itself on :80 because verification of the DNS name is done via HTTP.
You want to leave it open anyhow as Discourse will take care of any redirection from :80 to 443 for clients who try to visit the insecure URL. The same instance of nginx is listening on :80 and :443 so there’s nothing to be gained by shutting down that port, and as you’ve already learned there’s quite a lot to lose.
---
### Author:  [@gigperformer](https://meta.discourse.org/u/gigperformer)
#### Post date: [November 21, 2018, 6:28pm UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/9 "2018-11-21T18:28:47Z")
> [@Stephen](#):
>
> Let’s Encrypt needs to expose itself on :80 because verification of the DNS name is done via HTTP.
>
> You want to leave it open anyhow as Discourse will take care of any redirection from :80 to 443 for clients who try to visit the insecure URL.
Ah yes, if I’d known then what I had to later go off and learn to figure out why it didn’t work…
The thing is, I wasn’t using port 443 either. Externally, I was using a port in the high 10,000s and my firewall was redirecting those incoming requests to port 443.
Sigh
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [November 21, 2018, 6:34pm UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/10 "2018-11-21T18:34:50Z")
That’s always going to be the risk when you deviate from the recommended configuration.
There’s a lot of knowledge here on meta though - maybe next time you want to make those kinds of changes you can run them by us first and we can help you understand any implications and the safest way to make them.
One added benefit to the above is that anyone searching to do the same down the line will also see the advice when(if) they search.
---
### Author:  [@robbyoconnor](https://meta.discourse.org/u/robbyoconnor)
#### Post date: [November 24, 2018, 8:56pm UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/11 "2018-11-24T20:56:10Z")
> [@gigperformer](#):
>
> Thanks, Robby. The problem was due to the fact that I was blocking port 80 (seemed like a good idea from a security perspective) and didn’t realize that LetsEncrypt used port 80
You should keep port 80 open and do a redirect to HTTPS. This is how most of the web handles things.
---
### Author:  [@gigperformer](https://meta.discourse.org/u/gigperformer)
#### Post date: [December 11, 2018, 3:19am UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/12 "2018-12-11T03:19:34Z")
Thank you - but in general I don’t want to keep port 80 open — as I mentioned above, I don’t even expose port 443 publicly.
I guess I’ll just have to temporarily open it every few months, manually update LetsEncrypt and then close it again or else use the DNS challenge.
---
### Author:  [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [December 12, 2018, 12:50am UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/13 "2018-12-12T00:50:25Z")
The only difference between 80 and 443 is the certificate. Unless you don’t trust nginx it’s fine to leave open.
---
### Author:  [@joao\_pimentel\_ferrei](https://meta.discourse.org/u/joao_pimentel_ferrei)
#### Post date: [January 24, 2020, 2:12pm UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/14 "2020-01-24T14:12:08Z")
> [@robbyoconnor](#):
>
> There should be a cronjob that does it automatically for you.
which cronjob do you refer to? Should I add it manually or it was done when I installed discourse? Which command should I add to cronjob? Cause `certbot renew` is failing on the discourse certificate
---
### Author:  [@sedget](https://meta.discourse.org/u/sedget)
#### Post date: [January 20, 2021, 9:10am UTC](https://meta.discourse.org/t/how-to-renew-lets-encrypt/69183/15 "2021-01-20T09:10:09Z")
Got the same problem here, my certificate has expired on december 20