I'm running my Django application on Digital Ocean with Ubuntu 16.04/Nginx/Gunicorn. I issued a (SSL?) certificate by running the following command:

sudo certbot --authenticator webroot --webroot-path /home/user/app --installer nginx -d aaa.com -d www.aaa.com

however I now want to change my domain from aaa.com to bbb.com. How do I keep my certificate for my new domain? When I ran the command to issue the certificate, I assume it created various files such as the directory .well-known - and also added code in my Nginx conf. So do I simply run the same command again, with the new domain in?

sudo certbot --authenticator webroot --webroot-path /home/user/app --installer nginx -d bbb.com -d www.bbb.com

or do I just change the current code and replace it with the new domain? E.g. my Nginx conf looks like this:

ssl_certificate /etc/letsencrypt/live/aaa.com/fullchain.pem; # 
managed by Ce$
ssl_certificate_key /etc/letsencrypt/live/aaa.com/privkey.pem; # managed by $
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

I've already changed:

server {
    listen 80;
    server_name bbb.com www.bbb.com;
    location = /favicon.ico { access_log off; log_not_found off; }
    location /static/ {
        root /home/user/app;

to my new domain bbb.com.

Advice appreciated.

up vote 4 down vote accepted

According to this link, you can re-use your first command line, changing the host names and adding --force-renewal.

Example, for your case : sudo certbot --authenticator webroot --webroot-path /home/user/app --installer nginx -d bbb.com -d www.bbb.com --force-renewal

  • I re-used the command like you said and it worked but I didn't include the --force-renewal - what should I do to ensure it auto renews at the end of the year? – Zorgan Feb 27 at 9:52
  • let's encrypt certificate are only valid for 90 days! You should have a look at the documentation to (certbot.eff.org/#ubuntuxenial-nginx) to setup automatic renewal. – pim Feb 27 at 10:07
  • But couldn't I just redo the same command with the --force-renewal at the end? – Zorgan Feb 27 at 11:08
  • If your certificates for the new names are done, there is no need for --force-renewal. In any case, they are valid for 90 days. – pim Feb 27 at 11:45
  • Just went through your link and set up auto-renewal. Thanks! – Zorgan Feb 27 at 11:49

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.