letsencrypt-refresh.pl

#!/usr/bin/perl
use strict;
use warnings;

my $email = 'letsencrypt@sjor.sg';
my $sslroot = '/etc/ssl/private';
# This script assumes every hostname under __DATA__ has its .well-known pointing to the following directory:
my $webroot = '/var/www/well-known';

while(<DATA>) {
	my @domains = split /\s+/;
	my $domain = $domains[0];
	my $domaindir = "$sslroot/$domain";
	if(! -d $domaindir) {
		mkdir($domaindir);
	}
	chdir($domaindir);
	my @command = ("simp_le", "--email", $email, "-f", "account_key.json", "-f", "fullchain.pem", "-f", "key.pem", "--default_root", $webroot);
	foreach(@domains) {
		push @command, "-d", $_;
	}
	system(@command);
	chmod(0600, "account_key.json") || warn "Could not chmod account key: $!\n";
	chmod(0640, "key.pem") || warn "Could not chmod private key: $!\n";
	system("chgrp", "ssl-cert", "key.pem");
}

__DATA__
bulbasaur.sjorsgielen.nl
dazeus.org www.dazeus.org
sjorsgielen.nl www.sjorsgielen.nl
g.sjor.sg www.g.sjor.sg
private.sjorsgielen.nl
vakantiepeilingen.nl www.vakantiepeilingen.nl

Add to your crontab:

15 5 * * * $HOME/bin/letsencrypt-refresh 2>&1 | grep -v "Certificates already exist and renewal is not necessary"

In nginx, .well-known requests can be aliased using the following three lines in your server config block:

    location /.well-known {
        root /var/www/well-known;
    }