Renewing SSL Automatically for AdGuard Home: A Quick Guide & The Script

When you use AdGuard Home, it's important to keep your setup safe and working well, especially when it comes to SSL certificates. When you renew these certificates on a regular basis, your AdGuard Home instance stays a strong gatekeeper that keeps unwanted people from entering your digital space. This is how you can set up your SSL certificate renewal to happen automatically, so the process goes as smoothly as possible, with only a short break.

First Things First: Applying the Certificate

To get started, you'll need to manually apply for the certificate. This can be done using Certbot, a free, open-source software tool that automates the process of obtaining certificates from Let’s Encrypt. Here’s how you can generate your SSL certificate:

sudo certbot certonly --standalone -d yourdomain.com

This command initiates Certbot in standalone mode, which is sufficient for obtaining a certificate but note that it requires your web server to be temporarily stopped if it's running on port 80 or 443.

Automating Renewal: The Cron Job

To keep your SSL certificate up to date without regular manual intervention, you can employ a simple script within a cron job. Here’s a breakdown of a basic script that you can add to your cron tasks:

#!/bin/bash

# Path to SSL certificate
SSL_CERT_FILE="/etc/letsencrypt/live/YOURDOMAIN.COM/fullchain.pem"

# Check if the SSL certificate is nearing expiry
if openssl x509 -checkend 86400 -noout -in $SSL_CERT_FILE
then
    echo "Certificate is good for another day!"
else
    echo "Stopping AdGuard DNS..."
    /opt/AdGuardHome/AdGuardHome -s stop

    echo "Certificate has expired or will do so within 24 hours. Renewing..."
    certbot renew --preferred-challenges http

    echo "Certificate renewed."
fi

echo "Starting AdGuard DNS..."
/opt/AdGuardHome/AdGuardHome -s start

echo "Renewal process complete."

Adding Script to Cron

To ensure this script runs at regular intervals, you'll want to add it to your cron jobs. This can be done by editing your crontab with crontab -e and adding a line like:

0 2 * * * /path/to/your/script.sh

This sets the script to run at 2 AM every day, checking if your certificate is expiring within the next 24 hours and renewing it if necessary.

Consider the DNS Validation Approach

Even though the stand-alone method works well, there is a way that works even better and doesn't require DNS validation, so there is no downtime. To do this, you need to add a DNS record to show that you own the domain. This lets the renewal process happen without stopping your server. Click on the link to read more about AdGuard Home encryption: AdGuard Home encryption documentation

Wrapping Up

Setting up this automation will not only save you time, but it will also make your AdGuard Home setup safer. Your network will stay safe with minimal downtime thanks to automatic renewals that happen on a regular basis. This protects everything from your browsing history to your digital identity.