Automatic Let's Encrypt SSL Renewal, No Cron — OpenResty Edge

OpenResty Edge automates Let’s Encrypt SSL certificate renewal end-to-end: it schedules the next renewal about one month before expiry, ships the new certificate to every gateway cluster without a reload or restart, and reminds you in the console once a certificate is close to expiry (30 days or less of validity left) — no cron jobs, no shell scripts. This walkthrough shows the full flow, from adding domains to verifying HTTPS on a live gateway.

Add the domains to your Edge application

As always, let’s go to the OpenResty Edge’s Admin web console. This is our sample deployment of the console. Every user has her own local deployment.

This time we use our continuing sample application for the test-edge.com domain.

We can see that it already listens on the 443 port for SSL.

Let’s enter this application.

Here we need to demo sub-domain names, so we need to adjust the application’s settings first.

Let’s add a new wildcard domain name to this application.

Let’s push out this change to our gateway servers. Because Let’s Encrypt servers will need to verify our domains’ ownership shortly.

Release our pending changes.

Ship it!

Issue and auto-renew a Let’s Encrypt SSL certificate

Goto the SSL page.

We can see that there are no SSL certificates defined yet.

Let’s add a new certificate.

We support various different ways to issue new SSL certificates.

If you already have a certificate from another CA, you can instead upload an existing SSL certificate into Edge and skip issuance entirely.

Here we’d just demonstrate the Let’s Encrypt way.

Add the apex domain name test-edge.com to this certificate.

Add more sub-domain names.

Enter our api subdomain. It could be anything.

We could add even more.

We could use the batch input mode if we have many domains.

We can enter many domains here, line by line.

Quit the batch input mode.

All the domain names here must be resolved to the gateway servers of this OpenResty Edge deployment.

This requirement is also mentioned here.

On the terminal, we can use the dig command to test if the domain has already resolved to our gateway servers.

dig test-edge.com

We can see the valid DNS answer here.

And also test the other api subdomain.

dig api.test-edge.com

Again, the DNS answer is good.

The Let’s Encrypt servers need to access our gateway servers through these domains. This is because they must make sure that we indeed own these domains.

For wildcard domains, you must also use OpenResty Edge as the authoritative DNS name servers for the domains.

Agree to the Lets’ Encrypt Subscriber Agreement.

Save it.

We can see the new row for the Let’s Encrypt certificate.

The certificate source is Let’s Encrypt.

It has two domain names, as expected.

We can view the real time status here.

We can check the detailed progress by clicking on this status icon.

We can observe the detailed logs regarding the Let’s Encrypt certificate issuing process here.

We can see now the certificate has been issued.

Let’s quit this status page.

We can view the expiration time of the new certificate in this column.

We can see that the certificate will expire in 3 months.

And OpenResty Edge will automatically update the certificate when it is about to expire in the future.

We can see the scheduled next update time will be in 2 months. That is, one month before it expires.

We can also edit an existing Let’s Encrypt certificate.

We don’t make any changes here.

Or we can delete this certificate.

We don’t want to delete it now.

We can also disable a certificate without removing it.

It can then be re-enabled again.

We need to make a new release to push out our new certificate, as always.

Click on this button.

Ship it!

It is done now!

Now the new certificate has been pushed to all the gateway clusters and servers.

Our configuration changes do NOT require server reload, restart, or binary upgrade. So it’s very efficient and scalable.

OpenResty Edge will then automatically update these certificates from Let’s Encrypt again before they expire.

If for some reason some certificates fail to update, the user will see a console reminder like this once a certificate is close to expiry (30 days or less of validity left).

Renewal, in short: OpenResty Edge stores the certificate’s expiry and next-renewal timestamp in the UI, kicks off a fresh Let’s Encrypt issuance about one month before expiry, and rolls the new certificate out to every gateway cluster without a reload, restart, or binary upgrade. When a certificate is close to expiry (30 days or less of validity left), the console shows a reminder so it doesn’t silently expire.

Verify HTTPS and the Let’s Encrypt certificate on a gateway

Let’s open a new browser tab to access the test-edge.com site via https.

It works!

Also test the api subdomain.

It works too!

We can also pick up a gateway cluster server to test our new certificate on the terminal.

We choose a gateway server here near San Francisco.

Copy its public IP address ending with 133.

On the terminal, we can send an HTTPS request to this gateway server.

curl -I --resolve 'test-edge.com:443:138.68.231.133' https://test-edge.com/

It works!

We can check more details like the certificate information by passing the -v option.

curl -I --resolve 'test-edge.com:443:138.68.231.133' https://test-edge.com/ -v

Run this command.

We can indeed see our server certificate here. We can also see the certificate is indeed issued by Let’s Encrypt.

With HTTPS working on both the browser and the gateway, a natural follow-up is to redirect all plain HTTP requests to HTTPS via an Edge page rule so visitors never land on the unencrypted site.

FAQ

When does OpenResty Edge renew a Let’s Encrypt certificate?

Edge schedules the next renewal about one month before the certificate’s expiry date. Because Let’s Encrypt certificates last three months, that leaves roughly two months between issuance and the scheduled renewal, which is visible in the certificate row’s “next update” column.

Do I need a cron job or a script to renew certificates?

No. Renewal is handled inside Edge itself — there is no cron job to configure, no certbot binary to schedule, and no shell hook to write. The renewal timestamp lives in the admin console alongside the certificate. If you need to issue from other CAs like ZeroSSL, DigiCert, or Google Trust Services, Edge’s broader ACME-based SSL certificate automation works the same hands-off way.

Does renewing a certificate require reloading or restarting the gateway?

No. When Edge issues a renewed Let’s Encrypt certificate, it pushes the update to every gateway cluster and server through Edge’s configuration-sync layer, without a reload, restart, or binary upgrade. The article walks through this “ship it” step at the end of the SSL section.

What happens if an automatic renewal fails?

Edge does not currently send a notification for an individual failed renewal, but the console shows a reminder once a certificate is close to expiry (30 days or less of validity left), so it doesn’t quietly expire. If renewal keeps failing — for example, if Let’s Encrypt can no longer reach one of the domains — you can edit the certificate, adjust the domains, or delete and reissue it from the same page.

What is OpenResty Edge

OpenResty Edge is our all-in-one gateway software for microservices and distributed traffic architectures. It combines traffic management, private CDN construction, API gateway, security, and more to help you easily build, manage, and protect modern applications. OpenResty Edge delivers industry-leading performance and scalability to meet the demanding needs of high concurrency, high load scenarios. It supports scheduling containerized application traffic such as K8s and manages massive domains, making it easy to meet the needs of large websites and complex applications.

If you like this tutorial, please subscribe to this blog site and/or our YouTube channel. Thank you!

About The Author

Yichun Zhang (Github handle: agentzh), is the original creator of the OpenResty^® open-source project and the CEO of OpenResty Inc..

Yichun is one of the earliest advocates and leaders of “open-source technology”. He worked at many internationally renowned tech companies, such as Cloudflare, Yahoo!. He is a pioneer of “edge computing”, “dynamic tracing” and “machine coding”, with over 22 years of programming and 16 years of open source experience. Yichun is well-known in the open-source space as the project leader of OpenResty^®, adopted by more than 40 million global website domains.

OpenResty Inc., the enterprise software start-up founded by Yichun in 2017, has customers from some of the biggest companies in the world. Its flagship product, OpenResty XRay, is a non-invasive profiling and troubleshooting tool that significantly enhances and utilizes dynamic tracing technology. And its OpenResty Edge product is a powerful distributed traffic management and private CDN software product.

As an avid open-source contributor, Yichun has contributed more than a million lines of code to numerous open-source projects, including Linux kernel, Nginx, LuaJIT, GDB, SystemTap, LLVM, Perl, etc. He has also authored more than 60 open-source software libraries.