Hacker News Reader

For me, your second blocker has boiled down to a simple weekly cronjob:

0 9 * * 0 certbot renew --renew-hook "service nginx restart"

I'm sure there are cases where restarting nginx willy-nilly won't fly, but for non-mission critical it's wonderfully simple.

Cerbot is also great for the initial setup. I just add the non-SSL entry, run `certbot --nginx` and follow the simple prompts.

View on HN

You can use "service nginx reload" for a graceful reload with zero downtime.

This does not reload the certificates if the new cert is in the same place as the old.

It does. "service nginx reload" (and similar commands, like systemctl reload nginx in systemd territory) sends SIGHUP to the nginx master process on all distributions I'm aware of, and that will cause the certificate and key files to be re-read.

I've been using this in production for more than a year now, and if you google around a bit, most guides for automating renewal on nginx[1] will use that command.

[1]: https://www.digitalocean.com/community/tutorials/how-to-secu...

Ah, thanks for the reference. I only did restart because I had a vague recollection of reading that reload doesn't do the trick.

Reply on news.ycombinator.com