# Reliable Let's Encrypt renewals on RHEL / Rocky

A certificate can only be renewed in its last 30 days. A cron job that tries once a month can miss that window after a single failure, and the certificate expires.

## Use the packaged timer
The EPEL `certbot` package ships a systemd timer that runs twice a day:
```
sudo systemctl enable --now certbot-renew.timer
systemctl list-timers certbot-renew.timer
```
Remove any old monthly certbot cron entries.

## Reload the web server after renewal
A renewed certificate isn't used until the web server reloads. Add a deploy hook:
```
sudo install -m 755 /dev/stdin /etc/letsencrypt/renewal-hooks/deploy/reload-web.sh <<'H'
#!/bin/sh
systemctl reload httpd 2>/dev/null || systemctl reload nginx
H
```
Or, for the packaged timer, set it in `/etc/sysconfig/certbot`:
```
DEPLOY_HOOK="--deploy-hook 'systemctl reload httpd'"
```

## If you must use cron
```
17 3,15 * * * root /usr/bin/certbot renew -q --deploy-hook "systemctl reload httpd"
```

## Test
```
sudo certbot renew --dry-run
```