Replace the expired intermediate certificate

Why it matters

One of the intermediate certificates the server sends has expired, so clients that build the chain from what the server sends reject the connection. It usually comes from an old certificate bundle file that was never refreshed.

The fix

1. Download the current intermediate certificate bundle from your CA, or re-issue the certificate so the CA returns the current chain.
2. Replace the bundle file the server uses. Do not keep old intermediates in it, because an expired one in the sent chain can cause failures even when a valid path exists.
3. With certbot, a fresh renewal of the affected certificate writes a new fullchain.pem. Use that file in the server configuration. The folder /etc/letsencrypt/live/<name> is named after the first -d value of the original request, so run sudo certbot certificates to see the real name and path.
4. Reload the web server and check every certificate in the chain with the command below.

sudo certbot certificates
# force a new certificate for just this one (avoid --force-renewal on all certificates, it can hit rate limits)
sudo certbot renew --cert-name <name> --force-renewal
sudo systemctl reload nginx    # or apache2 / httpd
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | grep -E "^ *[0-9]+ s:|NotAfter"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject