Skip to content

Renewing LetsEncrypt Certificates

LetsEncrypt certificates expire every three months and must be renewed. This guide covers renewal for the current DTaaS package layouts.

Prerequisites

  • Administrative access to the host
  • certbot installed
  • Access to Docker commands

Step 1: Renew certificates

1
2
sudo certbot renew --dry-run
sudo certbot renew

CLI shortcut for generated deployments

If the DTaaS CLI created the deployment (dtaas deployment generate) and [common.security].certs-src in dtaas.toml points to the directory holding the renewed fullchain.pem / privkey.pem (e.g. /etc/letsencrypt/live/your-domain.com), one command replaces the manual copy and restart below:

1
dtaas platform update --certs --output-dir /path/to/deployment

The command validates the renewed pair: it must parse, the key must match the certificate, and neither the leaf nor any intermediate may have expired. It then stops traefik, swaps the new files into the deployment's certs/ directory (restoring the previous pair if anything goes wrong), restarts traefik and waits for it to come back up. On POSIX hosts it also restores 0600 on the private key; on Windows it prints a warning, because file permissions cannot be enforced there. If validation fails, the live certificates stay untouched. See the DTaaS CLI page for details.

The manual steps below apply to the deploy/dtaas/docker/* package layouts and the services project.

Step 2: Deploy to DTaaS server package

For the secure server package (deploy/dtaas/docker/secure-server):

1
2
3
4
sudo cp /etc/letsencrypt/live/your-domain.com/fullchain.pem \
  /path/to/DTaaS/deploy/dtaas/docker/secure-server/certs/fullchain.pem
sudo cp /etc/letsencrypt/live/your-domain.com/privkey.pem \
  /path/to/DTaaS/deploy/dtaas/docker/secure-server/certs/privkey.pem

For the integrated package (deploy/dtaas/docker/secure-server_with_integrated-gitlab):

1
2
3
4
sudo cp /etc/letsencrypt/live/your-domain.com/fullchain.pem \
  /path/to/DTaaS/deploy/dtaas/docker/secure-server_with_integrated-gitlab/certs/fullchain.pem
sudo cp /etc/letsencrypt/live/your-domain.com/privkey.pem \
  /path/to/DTaaS/deploy/dtaas/docker/secure-server_with_integrated-gitlab/certs/privkey.pem

Step 3: Restart Traefik in DTaaS package

Server package:

1
2
cd /path/to/DTaaS/deploy/dtaas/docker/secure-server
docker compose --env-file config/.env up -d --force-recreate traefik

Integrated GitLab package:

1
2
cd /path/to/DTaaS/deploy/dtaas/docker/secure-server_with_integrated-gitlab
docker compose --env-file config/.env up -d --force-recreate traefik

Step 4: Deploy to services project (if used)

If the platform services run from a project generated by dtaas-services, refresh that project's certs/ directory. Set CERTS_SRC in config/services.env to the certbot directory that holds the renewed certificates, then run from the project directory:

1
2
cd /path/to/services-project
sudo -E env PATH="$PATH" dtaas-services host setup

host setup copies the newest certificate pair from CERTS_SRC into certs/ as fullchain.pem and privkey.pem, and rebuilds the per-service certificate files and permissions.

Step 5: Restart affected services project containers

1
2
cd /path/to/services-project
docker compose -f compose.services.yml --env-file config/services.env up -d --force-recreate

If the ThingsBoard or GitLab compose stacks run in the same project:

1
2
docker compose -f compose.thingsboard.yml --env-file config/services.env up -d --force-recreate
docker compose -f compose.gitlab.yml --env-file config/services.env up -d --force-recreate

Verification

1
curl -I https://your-domain.com

Check the logs of the traefik service if needed.