Let's Encrypt + Cloudflare Certificate Manager
A comprehensive Bash script for automating SSL/TLS certificate provisioning and renewal using Let's Encrypt and Cloudflare DNS validation.
Overview
This script streamlines the process of obtaining and managing SSL certificates through Let's Encrypt with Cloudflare DNS-01 challenge validation. It handles certbot installation, credential management, certificate requests, and automatic renewal scheduling via cron jobs.
Features
- Automated certbot installation in an isolated Python virtual environment
- Cloudflare DNS-01 validation for certificate issuance
- Secure credential file management with restricted permissions
- Input validation for domains and email addresses
- Automatic renewal scheduling via cron job (configurable interval)
- Colored console output for improved readability
- Comprehensive error handling and logging
- Support for both primary and subdomain certificates
- Manual renewal capability without automatic scheduling
Requirements
- Linux system with root or sudo access
- Bash 4.0 or higher
- Python 3 with development headers
- APT package manager (Debian/Ubuntu based systems)
- Active Cloudflare account with API token access
Installation
- Download the script to your system:
sudo curl -O /usr/local/bin/certbot-manager.sh
sudo chmod 755 /usr/local/bin/certbot-manager.sh
- Run the script with root privileges:
sudo /usr/local/bin/certbot-manager.sh
Usage
Initial Certificate Setup
Execute the script and follow the interactive prompts:
sudo /usr/local/bin/certbot-manager.sh
The script will request the following information:
- FQDN (e.g., example.com or sub.example.com)
- Email address for Let's Encrypt notifications
- Cloudflare API token
Getting Your Cloudflare API Token
- Log into your Cloudflare account
- Navigate to Account Settings > API Tokens
- Create a token with DNS edit permissions for your domain(s)
- Copy the token and provide it when prompted
Certificate Renewal Options
After successful certificate creation, choose one of two renewal strategies:
Option 1: Automatic Renewal
- Sets up a cron job that runs every 2 months
- Runs at 2 AM on the 1st of every other month
- Certificates are automatically renewed before expiration
Option 2: Manual Renewal
- No automatic scheduling
- Run manual renewals using certbot commands
Directory Structure
| Location | Purpose |
|---|---|
| /opt/certbot | Python virtual environment for certbot |
| /root/certbot-cloudflare | Cloudflare API credential files |
| /etc/letsencrypt/live/ | SSL certificate files |
| /usr/local/bin/certbot-renewal.sh | Automatic renewal script |
| /var/log/certbot-renewal.log | Renewal operation logs |
File Locations
- Certificate chain:
/etc/letsencrypt/live/<domain>/fullchain.pem - Private key:
/etc/letsencrypt/live/<domain>/privkey.pem - Credentials file:
/root/certbot-cloudflare/cloudflare_<domain>.ini
Manual Renewal Commands
Renew all managed certificates:
/opt/certbot/bin/certbot renew
Renew a specific domain:
/opt/certbot/bin/certbot certonly --dns-cloudflare -d example.com
View renewal logs:
tail -f /var/log/certbot-renewal.log
Security Considerations
- Credentials files are restricted to root-only access (chmod 600)
- API tokens are not echoed to the terminal during input
- Script uses non-interactive mode for unattended operations
- All certificate operations use secure DNS validation
Error Handling
The script includes validation for:
- Domain name format compliance with DNS standards
- Valid email address format
- Non-empty input fields
- Certbot installation integrity
- Successful credential file creation
- Certificate request completion
If any operation fails, the script provides detailed error messages and exits gracefully.
Cronjob Schedule
The default automatic renewal cronjob runs:
- Time: 2:00 AM
- Frequency: 1st of every 2 months
- Pattern:
0 2 1 */2 * /usr/local/bin/certbot-renewal.sh
Modify the cron schedule manually by editing the crontab:
sudo crontab -e
Troubleshooting
Certbot Installation Fails
Ensure all dependencies are available:
sudo apt-get update
sudo apt-get install -y python3 python3-dev python3-venv libaugeas-dev gcc
Certificate Request Fails
Verify your Cloudflare API token has correct permissions and covers the target domain. Check that DNS records are properly configured in Cloudflare.
Cronjob Not Running
Verify the cronjob exists in crontab:
sudo crontab -l
Check the renewal log for execution details:
sudo tail -f /var/log/certbot-renewal.log
Support and Maintenance
- Script exit codes indicate success (0) or failure (non-zero)
- All operations are logged with timestamps and status indicators
- For Let's Encrypt rate limits, see https://letsencrypt.org/docs/rate-limits/
- Review Cloudflare documentation for API token management
# Disclaimer
## Legal Notice
This script is provided "as is" without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and noninfringement. The author and contributors shall not be liable for any claim, damages, or other liability, whether in an action of contract, tort, or otherwise, arising from, out of, or in connection with the software or the use or other dealings in the software.
### Usage Agreement
By using this script, you acknowledge that you:
- Are responsible for all actions performed by this script on your system
- Have obtained proper authorization to manage certificates for the specified domains
- Understand the implications of SSL/TLS certificate management
- Will comply with Let's Encrypt Terms of Service and Cloudflare Terms of Service
- Will not use this script for any illegal or unauthorized purposes
### Security Responsibility
- You are solely responsible for protecting your Cloudflare API tokens and credentials
- Store credentials securely and never commit them to version control
- Regularly rotate your API tokens and review access permissions
- Monitor certificate renewal logs for any anomalies or failures
- Implement additional security measures appropriate for your infrastructure
### Let's Encrypt Compliance
This script uses Let's Encrypt services. You agree to comply with:
- Let's Encrypt Terms of Service: https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf
- Let's Encrypt Subscriber Agreement
- Rate limits and usage policies defined by Let's Encrypt
Misuse of Let's Encrypt services may result in temporary or permanent account restrictions.
### Cloudflare API Usage
- You are responsible for managing your Cloudflare account and API token permissions
- Ensure your API token has appropriate scope and restrictions
- Monitor Cloudflare API usage for unauthorized access
- Review Cloudflare's API Terms of Service for compliance requirements
### System Impact
This script:
- Modifies system files and directories
- Installs Python packages and system dependencies
- Creates cron jobs that execute with root privileges
- Stores credentials in the file system
- Generates and manages certificates system-wide
Ensure you understand the full scope of changes before execution.
### No Warranty
The author makes no warranty that:
- The script will function without errors or interruption
- The script will meet your specific requirements
- Certificate renewal will always occur successfully
- The script is free from vulnerabilities or security issues
### Testing Recommendation
Before deploying to production systems:
- Test this script in a development or staging environment
- Verify all certificate operations complete successfully
- Review generated certificates and credentials
- Confirm cronjob scheduling and execution
- Test renewal processes multiple times
### Support and Liability
The author provides this script as-is. Technical support is not guaranteed. The author is not liable for:
- Loss of service or downtime
- Misconfiguration or incorrect usage
- Expired or invalid certificates
- Unauthorized access to credentials
- Any damages resulting from script usage
### Third-Party Services
This script interacts with third-party services:
- Let's Encrypt (certificate authority)
- Cloudflare (DNS provider)
- Python Package Index (for pip installations)
You agree to comply with the terms and policies of these services.
### Modifications
You are free to modify this script for your needs. However:
- Modified versions are your responsibility
- Modifications may introduce bugs or security issues
- Test thoroughly before deploying modified versions
- Clearly mark any modifications as your own
### Regulatory Compliance
You are responsible for ensuring your use of this script complies with:
- Applicable laws and regulations in your jurisdiction
- Your organization's policies and procedures
- Industry standards and best practices
- Data protection and privacy regulations
### Acknowledgment
By using this script, you acknowledge that you have read and understood this disclaimer and agree to be bound by its terms.
---
**Last Updated:** July 2026