I keep running into endless series of issues with certbot when it fails to renew a certificate etc. Recently I migrated my workflow to using the CloudFlare DNS authenticator. Pros and Cons of this approach:

Pros:

• it completely decouples certbot from nginx which is the main reason that renewals fail. nginx is not running → renewal fails. nginx config is not correct → renewal fails. Whenever I edit nginx config I have to be careful not to break certbot. All this pain goes away.

Cons:

• You have to migrate DNS to cloudflare, install a plugin, setup an API token. However, its one-time pain unlike the recurring pain above.

What the authenticator does?

When you use certbot you need to prove to it that you own the domain(s) for which you are requesting certificates. This can be done in various ways and there is an authenticator for each method. The Cloudflare DNS authenticator works by adding DNS records that provide proof of ownership to certbot. Here is essentially how it works:

• certbot says add XYZ record to the DNS of the domain (xyz.com) for which you are trying to request the certificate. Since only the owner of the domain can modify its DNS, if the record is added it proves to certbot you indeed own the domain
• the authenticator automatically adds the records to cloudflare – without you having to add them manually – this is where the API token (below) comes into the picture
• certbot verifies the records are there and issues the certificate
• the authenticator does a cleanup and removes the transient records added in step 1

What this means?

• You will need to host your DNS on CloudFlare. They have a generous free plan. You do not need to change your domain registrar. You only need to update the DNS provider (CloudFlare becomes the DNS provider)
• There is some software (certbot plugin that enables using CloudFlare for verification) you need to install on your webserver and I forget that now (see later)
• You need to setup an API token on CloudFlare on https://dash.cloudflare.com/profile/api-tokens. What this token does? It allows the software to make changes to DNS on your behalf
• Save the token on your webserver. I use the location /etc/letsencrypt/cloudflare/credentials.ini. Chmod this to 600

How to use it?

First do a dry-run:

sudo certbot certonly --cert-name optionswheel.net --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare/credentials.ini --dns-cloudflare-propagation-seconds 120 -d optionswheel.net -d www.optionswheel.net --force-renewal --dry-run

If it succeeds, do the actual run by removing the --dry-run flag.

The --force-renewal flag will update any pre-existing renewal config that was using another authenticator. E.g., I was earlier using the webroot authenticator. The --force-renewal flag updated it to using the Cloudflare authenticator.

Gotchas

• manually editing the renewal config does not work
• running this command also does not update the renewal config

sudo certbot reconfigure --cert-name nuvoice.ai \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare/credentials.ini \
  --dns-cloudflare-propagation-seconds 120

• what works is explicitly renewing certificates and adding the –force-renewal flag
• don’t forget to re-start nginx after renewing the certificate (sudo nginx -t && sudo nginx -s reload)

Run a particular renewal config

sudo certbot renew --cert-name YOUR_CERT_NAME --dry-run

Sample Config

$ cat  /etc/letsencrypt/renewal/xyz.conf
version = 5.7.0
archive_dir = /etc/letsencrypt/archive/xyz
cert = /etc/letsencrypt/live/xyz/cert.pem
privkey = /etc/letsencrypt/live/xyz/privkey.pem
chain = /etc/letsencrypt/live/xyz/chain.pem
fullchain = /etc/letsencrypt/live/xyz/fullchain.pem
[renewalparams]
account = 348...
authenticator = dns-cloudflare
server = https://acme-v02.api.letsencrypt.org/directory
key_type = ecdsa
dns_cloudflare_propagation_seconds = 120
dns_cloudflare_credentials = /etc/letsencrypt/cloudflare/credentials.ini
[acme_renewal_info]
ari_retry_after = 2026-08-20T02:12:43

note authenticator = dns-cloudflare which is the important part.

Official Docs:

• https://certbot-dns-cloudflare.readthedocs.io/en/stable/

The Cloudflare DNS Authenticator Plugin:

• https://snapcraft.io/certbot-dns-cloudflare

Let me know how it goes for you.