Certificate Renewal Runbook

The sites moved to CloudFront (casualarts.uk, www, shop, guides, game) use the ACM wildcard, which renews on its own as long as its DNS validation CNAME stays in Route 53. Everything on this page is about the two EC2 boxes that still terminate TLS themselves with certbot and Apache.

Run this from a local terminal, not on the server. It connects like a browser and prints the issuer and validity dates of the cert the site actually presents.

for h in conf piwigo rep; do
  echo "== $h.casualarts.uk"
  echo | openssl s_client -connect $h.casualarts.uk:443 -servername $h.casualarts.uk 2>/dev/null \
    | openssl x509 -noout -issuer -dates
done

An Amazon issuer means the name is behind CloudFront and ACM handles it. A Let's Encrypt issuer means it is one of the boxes below. The Confluence box only accepts 443 from allowlisted addresses, so run the check from one of those.

1. Confirm the failure (on the box)

sudo certbot renew --dry-run

Expect both conf and piwigo to fail with a connection timeout. A different error (403, 404, wrong IP) is a different problem; see Troubleshooting.

2. Open port 80 temporarily

Console: EC2 → Instances → confluencePiwigoCloudServer → Security tab → the security group → Edit inbound rules → Add rule: type HTTP, port 80, source Anywhere-IPv4 (0.0.0.0/0), description TEMP certbot renewal. Save.

CLI (from the Mac): this keeps the new rule's ID so step 5 removes exactly that rule and nothing else.

export AWS_REGION=us-west-2
SG=$(aws ec2 describe-security-groups \
  --filters Name=group-name,Values=confluencePiwigoCloudServer-private-access \
  --query 'SecurityGroups[0].GroupId' --output text)
echo "$SG"        # should print sg-..., not None

RULE=$(aws ec2 authorize-security-group-ingress --group-id "$SG" \
  --ip-permissions 'IpProtocol=tcp,FromPort=80,ToPort=80,IpRanges=[{CidrIp=0.0.0.0/0,Description="TEMP certbot renewal"}]' \
  --query 'SecurityGroupRules[0].SecurityGroupRuleId' --output text)
echo "$RULE"      # keep this terminal open

If $SG prints None, the name in the console is different. Copy the sg- ID from the instance's Security tab instead.

3. Check it is reachable

curl -I --max-time 10 http://conf.casualarts.uk/
curl -I --max-time 10 http://piwigo.casualarts.uk/

Any HTTP response (200, 301, 404) is fine. A timeout means the rule hasn't applied or there's another firewall in the way. ufw is inactive on this box, and Apache already listens on 80.

4. Renew (on the box)

sudo certbot renew
sudo systemctl reload apache2

If certbot says the certs are not yet due (you're early), use sudo certbot renew --force-renewal, or wait. There's no need to renew more often than every 60 days.

5. Close port 80 again

aws ec2 revoke-security-group-ingress --group-id "$SG" --security-group-rule-ids "$RULE"
curl -I --max-time 10 http://conf.casualarts.uk/   # should now time out

In the console, delete the TEMP certbot renewal rule. Afterwards, check that the inbound rules contain only the allowlist entries.

6. Verify

Re-run the expiry check from an allowlisted machine. Both notAfter dates should be about 90 days out. Set the calendar reminder for the next renewal.

This box's cert originally covered casualarts.uk, www and rep. After the apex and www moved to CloudFront, their challenges reached CloudFront and returned 403, which failed the whole renewal. On 26 October 2026 the existing cert was reissued for rep only. The cert name and file paths were kept, so the Apache config still points at /etc/letsencrypt/live/www.casualarts.uk/:

sudo certbot certonly --apache --cert-name www.casualarts.uk -d rep.casualarts.uk
sudo apachectl configtest && sudo systemctl reload apache2
sudo certbot renew --dry-run

The dead casualarts.uk/www 443 vhost was removed from /etc/apache2/sites-enabled/casualarts.uk.conf. From now on, renewal is just sudo certbot renew --dry-run to confirm, then let the timer do it.

systemctl list-timers | grep -i certbot
# nothing listed? (snap installs use snap.certbot.renew.timer)
sudo systemctl enable --now certbot.timer

On the Confluence box the timer still runs, but every attempt fails while port 80 is closed. That's expected. The failures show up in /var/log/letsencrypt/letsencrypt.log, which also makes them a useful early warning.

Two ways to stop the Confluence renewal being a manual job every 60 days: