---
title: 'QuickTip: Manually trigger certificate renewal on Avi Controller/NSX ALB'
url: 'https://patrik.kernstock.net/blog/quicktip-manually-trigger-certificate-renewal-on-avi-controller-nsx-alb'
markdown: 'https://patrik.kernstock.net/blog/quicktip-manually-trigger-certificate-renewal-on-avi-controller-nsx-alb.md'
date: '2021-08-30'
description: 'Avi Controller (or NSX Advanced Load Balancer, as known now) is able to automatically run scripts to renew your certificates your Virtual Services use – this is done by such called Certificate Management and ControlScript. The certificate renewal is, by default, triggered 7 days before the certific…'
taxonomy:
  category:
    - VMware
    - 'NSX & Avi'
  tag:
    - 'Avi Load Balancer'
    - Certificates
    - "Let's Encrypt"
    - QuickTip
---

# [QuickTip: Manually trigger certificate renewal on Avi Controller/NSX ALB](https://patrik.kernstock.net/blog/quicktip-manually-trigger-certificate-renewal-on-avi-controller-nsx-alb)

   August 30, 2021    1 min 

   [VMware](https://patrik.kernstock.net/category:VMware) [NSX & Avi](https://patrik.kernstock.net/category:NSX%20%26%20Avi)    [Avi Load Balancer](https://patrik.kernstock.net/tag:Avi%20Load%20Balancer) [Certificates](https://patrik.kernstock.net/tag:Certificates) [Let's Encrypt](https://patrik.kernstock.net/tag:Let%27s%20Encrypt) [QuickTip](https://patrik.kernstock.net/tag:QuickTip)  

 Note

This article is more than 5 year(s) old – information may be outdated.

 ![QuickTip: Manually trigger certificate renewal on Avi Controller/NSX ALB](https://patrik.kernstock.net/images/2/0/2/1/-/2021-08-2201-03-59-pvun2iwp-2280b798.png?g-b3a1b014 "QuickTip: Manually trigger certificate renewal on Avi Controller/NSX ALB") 

Avi Controller (or NSX Advanced Load Balancer, as known now) is able to automatically run scripts to renew your certificates your Virtual Services use – this is done by such called `Certificate Management` and `ControlScript`.

The certificate renewal is, by default, triggered 7 days before the certificate expiry. Or to be more exact, just right before the penultimate certificate expiry notification as configured on your controller. For more information see [Avi’s documentation for "Customizing Notification of Certificate Expiration" here](https://avinetworks.com/docs/latest/customizing-notification-of-certificate-expiration/).

## Why?

This functionality is also great for using the free, well-known certificate authority Let’s Encrypt. I’m currently working on quite some improvements [to the Let’s Encrypt script for Avi Controller](https://github.com/avinetworks/devops/pull/237) and manually triggering the renewal process makes testing just so much easier.

## Right to the magic

1. Login to your Avi Controller/NSX ALB via SSH using `admin` (or any other user having permissions to login via SSH)
2. Then type `shell` to open and login into Avi’s custom shell:

    ```text
    admin@avicontroller:~# shell
    Login: admin
    Password:
    ```
3. Then you can use the `renew` command to trigger certificate renewal manually just like this:

    ```
    [admin:avicontroller.]: > renew sslkeyandcertificate patrik.kernstock.net\ ECDSA
    Certificate Renewed
    STDOUT -
    Running version 0.9.0
    Debug enabled.
    dry_run is: False
    disable_check is: False
    directory_url is https://acme-v02.api.letsencrypt.org/directory
    Reusing account key.
    Parsing account key...
    Parsing CSR...
    Found domains: patrik.kernstock.net
    [...]
    ```

Tip: You can also type `renew sslkeyandcertificate` and TAB to autocomplete the names for you.

Thanks to Nikhil from Avi Engineering team for bringing this to my attention! That’s really handy.

##     Comments    

 Sort by: 

Loading comments...

---

## Navigation

- Parent: [Blog](https://patrik.kernstock.net/index.md)
- Previous: [Automate certificate renewal via Let's Encrypt on Avi/NSX ALB](https://patrik.kernstock.net/blog/automate-certificate-renewal-via-lets-encrypt-on-avi-nsx-alb.md)
- Next: [Get admin password of the Embedded Harbor Registry on the Supervisor Cluster](https://patrik.kernstock.net/blog/quicktip-get-admin-password-of-the-embedded-harbor-registry-on-the-supervisor-cluster.md)