How Let's Encrypt renewal works (90-day model)
Yes — by design. Let's Encrypt certificates are valid exactly 90 days, deliberately short so rotation stays cheap and compromise windows small.
The machinery: a systemd timer (Certbot installs it) checks twice daily and renews any certificate within 30 days of expiry — no human involvement. Verify yours:
systemctl list-timers | grep certbot— look for a recent run and the next scheduled one.certbot renew --dry-run— a full rehearsal against the staging environment, no rate limits burned.
On cPanel hosting you never touch Certbot: AutoSSL renews every domain automatically. The sections below cover diagnosing the rare failures.
Checking your renewal timer status
On Let's Encrypt, the honest summary is that defaults matter more than brand names — a well-set budget plan outranks a mis-tuned premium one. WebJi® documents its defaults openly and adjusts them per ticket when workloads need it.
Testing renewal with a dry run
Two practical notes on certbot: it interacts directly with caching and database response, and misconfiguration is the most common cause of 'hosting is slow' tickets. WebJi® support checks it as part of standard migrations.
Fixing failed HTTP-01 challenges
Diagnose HTTP-01 failures in order:
- Port 80 open? Test from outside:
curl -I http://yourdomain.com/.well-known/acme-challenge/test— a 404 is fine (proves reachability); a timeout means firewall or DNS. - HTTPS redirect excluding the challenge? Force-HTTPS rules must not redirect the acme-challenge path before Certbot serves the token.
- DNS pointing at this server? The A record must answer at the machine running Certbot — stale DNS after a migration is the classic silent killer.
- CAA records? A restrictive CAA must list letsencrypt.org.
After any fix, certbot renew --dry-run proves it. On shared hosting, AutoSSL handles all of this — its failure log in SSL/TLS Status names the exact failed check.
Renewal inside cPanel AutoSSL
Install the certificate on the account that actually serves the site, force HTTPS, then view the page source for http:// images, stylesheets or scripts. The padlock stays broken until those are HTTPS too. Renewal should be automatic; if the padlock disappears, check that the certificate is still bound to this hostname.
Monitoring and expiry alerts
Monitoring and expiry alerts. Do the change this heading names on one site first, then check it in a private browser window or in the mail client, depending on the topic. Change one setting at a time, and undo it if the result is wrong before you try the next. If you want the Jaipur desk to look with you, email support@webji.services — that mailbox is staffed 24/7 in Hindi and English. Phone +91 141 4941811 is business hours only.
Force-renewing safely
Two practical notes on ACME HTTP-01 challenge: it interacts directly with caching and database response, and misconfiguration is the most common cause of 'hosting is slow' tickets. WebJi® support checks it as part of standard migrations.
Frequently Asked Questions
Does Let's Encrypt renew certificates automatically?
The phone number is +91 141 4941811. Call it in business hours. It is not staffed as a 24/7 helpline, and a 2 a.m. server problem will not be picked up there. For round-the-clock help, email support@webji.services or open a ticket at https://billing.webji.in/submitticket.php?step=2&deptid=10. Email is answered in Hindi and English, usually within 60 minutes.
How do I check when my Let's Encrypt certificate expires?
Yes — by design. Let's Encrypt certificates are valid exactly 90 days, deliberately short so rotation stays cheap and compromise windows small.
Why did my Let's Encrypt certificate fail to renew?
Yes — by design. Let's Encrypt certificates are valid exactly 90 days, deliberately short so rotation stays cheap and compromise windows small. The question here is: Why did my Let's Encrypt certificate fail to renew.
What does certbot renew --dry-run do?
certbot renew --dry-run — a full rehearsal against the staging environment, no rate limits burned.
How do Let's Encrypt renewal challenges work?
Yes — by design. Let's Encrypt certificates are valid exactly 90 days, deliberately short so rotation stays cheap and compromise windows small. The question here is: How do Let's Encrypt renewal challenges work.
Does cPanel AutoSSL use Let's Encrypt?
Linux shared and WordPress plans use cPanel. Windows plans use Plesk. The panel login is separate from the client area where you pay invoices and open tickets. If you need a specific panel on a VPS, say so in the quote request to support@webji.services — it is not assumed on every unmanaged server.
Is WebJi® an Indian company?
Yes. WebJi® is headquartered in Jaipur, Rajasthan and has operated since 2005. Billing, support and governance all run from India.
Do you provide GST invoices?
Every purchase and renewal gets a GST invoice with our GSTIN, and hosting prices are quoted exclusive of 18% GST. Claim input credit as applicable.