How could I automate the generation of SSL certificates for different subdomains? In my workflow, different subdomains ab.mydomain.com, cd.mydomain.com, ab.mynewdomain.com, etc. will point to the IP of my Nginx machine.

I want to generate SSL certificates for these subdomains configured on my Nginx. How could I automate the generation of SSL certificates? Is there a way? Is there any library that can do this for me? I can also start with free SSL certificates, that will not be a problem.

I tried to search this, but could not find any answer.

  • Check out letsencrypt. They have a tool which generates & renews certificates. You need to set up a scheduled task to call "certbot renew". My advice is don't let certbot auto modify your nginx config, just get the certificates and configure nginx manually. Jun 5, 2020 at 4:20
  • @AdmiralNoisyBottom Could you please point me to a tutorial / steps?
    – Amanda
    Jun 5, 2020 at 4:29
  • @AdmiralNoisyBottom Also, I want to skip the questions that are asked during SSL certificate generation. Is there a way to supply the answers as arguments while invoking the utility?
    – Amanda
    Jun 5, 2020 at 4:32
  • From memory passing -q to certbot causes it to be quiet and provide no output or ask questions. A cron job calling "certbot -q renew" will renew all certificates within 30 days of expiring. Jun 5, 2020 at 4:40
  • There is a standardized protocol called ACME. It allows to interact with a CA and make it generate certificates, after validation. This is what Let's Encrypt uses, but other CAs exist that allows to use this protocol. Jun 7, 2020 at 0:40

1 Answer 1


Admiral Noisy Bottom is right, LetsEncrypt can generate valid certificates for you, and certbot is one of the easiest ways to do that.

You can find certbot instructions here which differ slightly for each platform.

Certbot will make the changes to your nginx configuration for you, if you run:

sudo certbot --nginx

You may need to answer some questions the first time you run it, but for future renewals it will be automatic.

(You might want to back up your nginx config first! But I've never had a problem with it.)

Don't forget to follow their instructions at the end of the process, to add a cronjob for automatic renewal.

One mistake I have in the past was to use crontab -e instead of creating a file at /etc/cron.d/certbot. Adding a line to the crontab can work, but in that case you need to remove the root argument from the cron line. It's easier just to follow their instructions exactly.

  • I want to automate the QA part too. Is there a way to do that?
    – Amanda
    Jun 8, 2020 at 6:21
  • @Amanda You may be able to use curl in a shellscript. To actually test against browsers you could consider puppeteer or Selenium. Jun 10, 2020 at 4:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .