# Automating SSL Certificate Renewal

**URL:** <https://forum.pritunl.com/t/automating-ssl-certificate-renewal/3657>\
**Category:** Pritunl VPN\
**Tags:** pritunl\
**Created:** [December 16, 2025, 2:05pm UTC](https://forum.pritunl.com/t/automating-ssl-certificate-renewal/3657 "2025-12-16T14:05:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Moor](https://forum.pritunl.com/user_avatar/forum.pritunl.com/moor/32/1002_2.png) [@Moor](https://forum.pritunl.com/u/Moor)\
**Post date:** [December 16, 2025, 2:05pm UTC](https://forum.pritunl.com/t/automating-ssl-certificate-renewal/3657/1 "2025-12-16T14:05:30Z")

</div>

Hi everyone,

Like many of you, I have to handle annual SSL certificate renewals. I currently manage this process via Ansible for my other services, and I would like to implement the same workflow for Pritunl.

I am aware that Pritunl stores certificates in the MongoDB database. Has anyone successfully automated the renewal process, perhaps using the CLI?

Most importantly, I am looking for a solution that applies the new certificate **without disconnecting active users**. Any advice or examples would be greatly appreciated.

Thanks!

---

<div class="post-metadata">

**Author:** ![Moor](https://forum.pritunl.com/user_avatar/forum.pritunl.com/moor/32/1002_2.png) [@Moor](https://forum.pritunl.com/u/Moor)\
**Post date:** [December 17, 2025, 9:28am UTC](https://forum.pritunl.com/t/automating-ssl-certificate-renewal/3657/2 "2025-12-17T09:28:30Z")

</div>

I discovered that I can update the certificate and key directly using the CLI commands: `pritunl set app.server_cert` `pritunl set app.server_key`

However, the missing piece is how to **reload the web server configuration** to apply these changes without restarting the entire Pritunl service (and consequently dropping active VPN connections).

When updating settings via the Web GUI, it seems to handle this gracefully - restarting the web interface while keeping VPN tunnels alive. Does anyone know the specific CLI command to trigger this “web-only” reload?

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [December 17, 2025, 11:50am UTC](https://forum.pritunl.com/t/automating-ssl-certificate-renewal/3657/3 "2025-12-17T11:50:41Z")

</div>

It should restart within 63 seconds after running the set commands. The server will sync the settings every 60 seconds and the web server will compare for changes every 3 seconds. When a change is found it will log `Settings changed, restarting server...` and restart the web server.

---

<div class="post-metadata">

**Author:** ![Moor](https://forum.pritunl.com/user_avatar/forum.pritunl.com/moor/32/1002_2.png) [@Moor](https://forum.pritunl.com/u/Moor)\
**Post date:** [December 17, 2025, 12:08pm UTC](https://forum.pritunl.com/t/automating-ssl-certificate-renewal/3657/4 "2025-12-17T12:08:15Z")

</div>

You are correct - I missed that in the logs. The web server did restart, but my browser cached the old certificate, making it look like it was still expired.

Thanks for the help!