Let's Encrypt Config Generator

What is this tool?

The Let's Encrypt Automation Generator creates bash scripts for provisioning and auto-renewing free SSL/TLS certificates using Certbot.

Let's Encrypt has transformed web security by providing free, automated certificates. However, configuring Certbot for different web servers (NGINX, Apache) or setting up DNS-01 challenges for Wildcard certificates can be complex. This tool generates foolproof scripts that handle installation, certificate requests, and systemd timers for automatic renewal.

How to Use This Tool

1. Select Challenge Type: Choose between HTTP-01 (requires Port 80 open) or DNS-01 (requires API access to your DNS provider, perfect for Wildcard certs or internal servers).

2. Choose Web Server Plugin: Select the NGINX or Apache plugin. Certbot will automatically modify your server blocks to serve the ACME challenge and install the certificate.

3. Configure Auto-Renewal: The script sets up a cron job or systemd timer to check certificate expiration twice daily, renewing automatically if less than 30 days remain.

4. Post-Hook Actions: Configure hooks (e.g., systemctl reload nginx) to gracefully reload your web server after a successful renewal, ensuring the new certificate is loaded into memory without dropping connections.

Best Practices

Always use the `--nginx` or `--apache` plugins if you have them installed, as they handle the HTTP-01 challenge seamlessly without requiring server downtime.
If you cannot use Port 80 (e.g., your ISP blocks it or it's an internal server), use the DNS-01 challenge. This requires a DNS plugin (like `certbot-dns-cloudflare`).
Use ECDSA keys (`--key-type ecdsa`) instead of RSA. ECDSA keys are significantly smaller, resulting in faster TLS handshakes and reduced CPU overhead.
Configure a strong notification email so Let's Encrypt can notify you 20 days before a certificate expires if your auto-renewal silently fails.

Common Mistakes

Running `certbot --standalone` while NGINX or Apache is already running. The standalone plugin needs to bind to Port 80, which will fail if a web server is already using it.
Setting a cron job to restart the server on every check. Let's Encrypt recommends checking twice daily, but you should only reload the web server if the certificate was *actually* renewed (using `--deploy-hook`).
Hitting Rate Limits. Let's Encrypt limits you to 5 duplicate certificates per week. Always use the `--test-cert` (staging) flag when testing your automation scripts.

Security Notes

Never run your web server as root. While Certbot requires root to bind to Port 80 or modify `/etc/letsencrypt`, your actual web server should drop privileges.
Protect your `/etc/letsencrypt/archive` directory. It contains your private keys. Ensure permissions are strictly `700` (root only).
Use the DNS-01 challenge for Wildcard certificates (`*.example.com`). HTTP-01 challenges cannot be used to issue wildcard certs.

Production Tips

Use `systemd` timers instead of `cron` for renewals. Systemd timers provide randomized delays (`RandomizedDelaySec`), preventing millions of servers from hitting the Let's Encrypt API at the exact same second.
If you are using Docker, do not install Certbot inside your application container. Run a dedicated Certbot container and share a Docker volume (e.g., `/etc/letsencrypt`) with your NGINX container.
Use OCSP Stapling. While Certbot can configure this, ensure your NGINX/Apache config has `ssl_stapling on;` to improve privacy and connection speed for your users.

Frequently Asked Questions

What is the difference between HTTP-01 and DNS-01 challenges?

HTTP-01 proves ownership by placing a specific file on your web server (requires Port 80). DNS-01 proves ownership by creating a specific TXT record in your DNS zone (requires DNS provider API access).

Do Let's Encrypt certificates expire?

Yes, every 90 days. This short lifetime limits damage from key compromise and encourages automation. Our generator creates scripts that automatically renew them after 60 days.

Can I get a Wildcard certificate?

Yes, but ONLY using the DNS-01 challenge. You cannot use the standard NGINX or Apache plugins (HTTP-01) to get a wildcard certificate.

How We Keep Your Configs Safe & Valid

Built-in Error Checking

Every file is checked against official rules. We catch missing fields and bad syntax. YAML indentation errors are flagged right away. Kubernetes, Terraform, and Docker specs are all covered. API versions and labels are verified too. You get valid output every time you generate.

100% Private & Local

All tools run in your browser only. Your API keys never leave your machine. We do not use any tracking scripts. No data is sent to any server. Passwords and secrets stay on your device. Crypto operations use the Web Crypto API. Your privacy is fully protected at all times.

Secure Settings by Default

Configs use safe defaults out of the box. Containers run as non-root users. Root filesystems are set to read-only. Dangerous Linux capabilities are dropped. Network policies limit pod-to-pod traffic. TLS 1.3 is enabled for web servers. Security headers are added where needed.

Ready for CI/CD & Git

Output files are ready for your Git repo. Use them with ArgoCD, Flux, or GitHub Actions. Files use clear formatting and comments. Code review is easy for your team. Indentation and key order are consistent. Test in staging before going to production. Every file is clean and well-structured.

Infrastructure as Code

Store configs in Git alongside your code. Terraform modules include typed variables. Backend configs support remote state locking. Outputs work across multiple modules. Ansible playbooks use clear task steps. Chef and Puppet configs are also supported. Every file works with version control tools.

Monitoring & Tracing

Set up Prometheus with auto-discovery rules. Create Grafana dashboards with template variables. Add alerting rules with severity labels. Use OpenTelemetry for trace collection. Forward logs to Loki or Elasticsearch. Connect to Jaeger or Tempo for tracing. Monitor metrics, logs, and traces together.

Container & Docker Safety

Dockerfiles use multi-stage builds for small images. Base images are pinned to exact versions. Dev files are excluded from final images. Health checks are added for orchestrator use. Containers switch to non-root users. Docker Compose uses named volumes and networks. Resource limits are set in deploy configs.

Multiple Output Formats

Export as YAML, JSON, HCL, or TOML. Kubernetes uses YAML with proper separators. Terraform uses HCL with correct escaping. JSON output has consistent indentation. Copy to clipboard with one click. Preview output with syntax highlighting. Line numbers help you review quickly.