Tips and tricks

Tested on Mac OS X

bash script:

#!/bin/zsh

set -euo pipefail

echo "======================================="
echo " Certbot Manual + Per-Site SSL Export"
echo "======================================="
echo

# 1. Read domain
read "SITE?Enter the domain (example: zoomthe.me): "
if [[ -z "$SITE" ]]; then
  echo "❌ Domain cannot be empty"
  exit 1
fi

LIVE_DIR="/etc/letsencrypt/live/$SITE"
DEST_DIR="$HOME/certbot/ssl"

mkdir -p "$DEST_DIR"

echo
echo "▶ Running certbot for:"
echo "  - $SITE"
echo "  - www.$SITE"
echo

# 2. Run certbot (manual HTTP challenge)
sudo certbot certonly \
  --manual \
  --preferred-challenges http \
  -d "$SITE" \
  -d "www.$SITE"

echo
echo "▶ Certbot finished. Verifying certificate files..."

FULLCHAIN_SRC="$LIVE_DIR/fullchain.pem"
PRIVKEY_SRC="$LIVE_DIR/privkey.pem"

if [[ ! -f "$FULLCHAIN_SRC" ]]; then
  echo "❌ Missing: $FULLCHAIN_SRC"
  exit 1
fi

if [[ ! -f "$PRIVKEY_SRC" ]]; then
  echo "❌ Missing: $PRIVKEY_SRC"
  exit 1
fi

echo "✅ Certificate files found"

# 3. Per-site destination filenames
FULLCHAIN_DST="$DEST_DIR/$SITE.fullchain.pem"
PRIVKEY_DST="$DEST_DIR/$SITE.privkey.pem"

echo
echo "▶ Copying certificates to:"
echo "  $FULLCHAIN_DST"
echo "  $PRIVKEY_DST"

sudo cp "$FULLCHAIN_SRC" "$FULLCHAIN_DST"
sudo cp "$PRIVKEY_SRC"   "$PRIVKEY_DST"

# 4. Fix ownership so user can use them without sudo
sudo chown "$(id -u):$(id -g)" \
  "$FULLCHAIN_DST" \
  "$PRIVKEY_DST"

echo
echo "✅ Done."
echo
ls -lah "$FULLCHAIN_DST" "$PRIVKEY_DST"

manual – here

you might need to contact your hosting company support for apache restart if it’s shared hosting