How to auto-renew Let’s Encrypt certificates in Debian 10

If Certbot is installed in Debian, renewal of certificates should be already automated and there is nothing else to do:

The Debian Certbot package installs a systemd timer which runs every 12 hours, calling a Certbot service. The Certbot service then executes the Certbot command for renewing expiring certificates.

To make sure the certbot timer is running, check the list of active timers:

$ systemctl list-timers

Or look at the status of the Certbot timer itself:

$ systemctl status certbot.timer

To see what exactly the Certbot service does:

$ less /usr/lib/systemd/system/certbot.service

More: Certbot - User Guide