Renew an HTTPS certificate in Velocity
This task is for administrators of sites served by Exponential Velocity. Velocity checks a certificate before use, watches the files, renews ACME certificates in the background and swaps a renewed certificate in without a restart (Velocity HTTPS and certificates).
Contents
Before you start
- Shell access as root (or the user Velocity runs as).
- Know the certificate's source: your own files (
velocity.ini [HTTPSSettings] CertificateandKey), or a mode such asletsencryptin the site's Velocity configuration (Q.web.https).
See what is served
./console exp:velocity ssl show --allow-root-user
qbixconsole ssl:showWatch the days left: below 14 for a CA certificate means renewal has been failing for two weeks; acme.lastError says
why. From outside:
openssl s_client -connect www.example.gov:443 -servername www.example.gov </dev/null 2>/dev/null | openssl x509 -noout -datesRenew
| Source | Do |
|---|---|
| Let's Encrypt or another ACME CA | nothing normally: renewal runs in a background job when a third of the lifetime is left (renewAt 0.33), with growing pauses after failures. To force it: ./console exp:velocity ssl renew --apply www.example.gov --allow-root-user |
| Your own files (from your organization's certificate service) | put the new fullchain.pem and privkey.pem in place at the configured paths; Velocity checks the files every watchInterval (60 seconds) and presents a valid new pair to the next connection |
Renewal failing with "Invalid response from .../.well-known/acme-challenge/...": port 80 does not reach this server;
open it, proxy that path to Velocity, or use the webroot option.
Check it worked
ssl showlists the new expiry date.- From outside,
opensslshows the newnotAfter. - No restart was needed; if the old certificate is still served after a few minutes, read Velocity's error log
(
./console exp:velocity status --allow-root-usernames it).
Back up Velocity's ssl/ directory: the ACME account keys in it cannot be made again.
Related pages
- Switch Velocity to Let's Encrypt
- Certificate expiry
- Velocity HTTPS certificates (hosting)
- Deploying, section 6
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.