Renew Let's Encrypt certificate at a time of my choosing

[rogermarlow]

I am running a small web app in a very locked down environment due the nature of the data it is handling. The firewall only allows known IP addresses to connect via port 80. This interferes with the certificate renewal process. If the renewal process could be triggered then one option would be to open port 80 to all IP addresses just for the renewal process then restrict it again. The question, then, is how to trigger the renewal process without just allowing the certificate to expire. Alternatively, is the time of renewal completely deterministic, in which case we could plan to open the firewall to accommodate it.

[nickhammond]

@rogermarlow I don't think there's a way to do it manually at the moment, this thread has a similar request basecamp/kamal-proxy#123

[rogermarlow]

Thanks. That thread talks about "deleting the stored certificate from $HOME/.config/kamal-proxy/certs and re-deploying;" which pretty much answers it.

In the meantime I worked out how to manually source certs which I would have to repeat every 90 days. Is that worse than having to change the firewall config every 90 days and wait for the auto renewal?

I will report back...