Renew the certificate before it expires

Why it matters

A certificate that is close to its end date will cause a site outage if it is not renewed in time. Automatic renewal normally replaces certificates well before then, so this often means renewal has silently stopped working.

The fix

1. Find out how this certificate is meant to be renewed (ACME client, hosting platform or manual purchase) and whether that mechanism ran recently.
2. For certbot, test renewal without changing anything using the dry run below. Fix whatever it reports (port 80 blocked, DNS changed, CAA excludes your CA, an old plugin or webroot path) and run a real renewal.
3. Check that the renewal job exists and runs (systemctl list-timers for the certbot timer, or the crontab).
4. Make sure the web server is reloaded after renewal so it serves the new certificate. certbot's deploy hook or the nginx and apache plugins do this.
5. For purchased certificates, order the renewal now and put a reminder in a shared calendar. Add an expiry monitor that alerts at least two weeks ahead.

sudo certbot renew --dry-run
systemctl list-timers | grep certbot
sudo certbot certificates

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject