Let’s Encrypt SSL with Auto-Renewal for WordPress

Why Standard Certbot Renewal Can Cause Downtime

Certbot automates certificate issuance and renewal by proving domain ownership to the Let’s Encrypt Certificate Authority. It can request certificates, configure HTTPS, track expiration, renew certificates, and revoke them when necessary.

• Certbot sends a Certificate Signing Request (CSR).
• A temporary Certificate Management Agent starts a Python web server for validation.
• Let’s Encrypt validates domain ownership through HTTP requests on port 80.
• Port 80 is normally already used by the website’s application server.

Another limitation is that Certbot’s temporary Python validation server can be affected by unrelated incoming HTTP traffic because it operates in a simple validation-oriented mode rather than as a full production web server.

Zero-Downtime Renewal Solution

To avoid stopping the WordPress web server, the built-in Let’s Encrypt add-on inserts an intermediate reverse-proxy layer into the HTTP traffic flow during validation.

Routing Traffic to the Proxy

During validation, firewall and NAT rules redirect incoming HTTP traffic from website port 80 to an intermediate proxy port. The add-on then separates ordinary website traffic from ACME validation requests.

The routing logic is applied with nftables on supported AlmaLinux systems or with iptables/ip6tables on other supported stacks.

PROXY_PORT=12347
LE_PORT=12348

# Incoming HTTP traffic on port 80 is temporarily redirected
# through the proxy while Let’s Encrypt validation is active.

# The proxy then decides whether the request should go to:
# - the WordPress web server on port 80, or
# - the ACME validation service on port 12348.

Intermediate Reverse Proxy

The add-on uses Tinyproxy as a lightweight intermediate HTTP/HTTPS proxy. Its fast startup makes it suitable for temporarily filtering certificate-validation traffic without interrupting the WordPress application.

Port 12347

ConnectPort 80
ConnectPort 12348

AddHeader "X-Forwarded-Proto" "http"

ReversePath "/" "http://127.0.0.1/"
ReversePath "/.well-known/acme-challenge/" \
"http://127.0.0.1:12348/.well-known/acme-challenge/"

ReverseOnly Yes
ReverseMagic Yes

The ReversePath rules provide the core filtering logic:

• Requests containing /.well-known/acme-challenge/ are sent to the Let’s Encrypt validation server on port 12348.
• All ordinary HTTP traffic is sent back to the user’s WordPress web server on port 80.

WordPress Use Case

During installation of a supported WordPress package, enable the Install Let’s Encrypt SSL with Auto-Renewal option to configure automated certificate issuance and renewal.

WordPress Cluster

In a clustered WordPress environment, validation traffic is redirected from the load balancers to the primary or initially created node where the certificate-validation service is running.

WordPress Standalone

In a standalone WordPress container based on certified LLSMP or LEMP templates, the same proxy-filtering principle is applied inside the environment.

• ACME challenge requests are sent to port 12348.
• Normal HTTP requests continue to the website’s web server on port 80.

Renewing Certificates with the Webroot Authenticator

An alternative renewal method is the Certbot webroot authenticator. It is particularly useful for heavily loaded websites because it can validate domain ownership without interrupting the active web server.

${webroot-path}/.well-known/acme-challenge

http://example.com/.well-known/acme-challenge/{validation-token}

After successful validation, Certbot receives the certificate files. Let’s Encrypt certificate data is normally available under:

/etc/letsencrypt/live/

The files in the live directory are typically symbolic links to the corresponding certificate files stored in the Let’s Encrypt archive directory.

What’s next?