Sign in

sec_error_expired_certificate on the clients landing page. auto-renew was supposed to prevent this!

Solvedcertificatelets-encryptssl37 replies · 662 views · started
Reply
  1. Kofi Stone
    @kofi.stone40

    Customer emailed us a screenshot this morning, the client's landing page now shows this to everyone:

    The error says SEC_ERROR_EXPIRED_CERTIFICATE 😭 i set up Certbot months ago exactly so this would never happen. No warning emails, no alerts, nothing. i need to fix it fast, but i also want to understand why the automation failed so Im not back here in three months. Detailed answers welcome, Im comfortable digging into the server.

    1
  2. Ibrahim Tanaka
    @ibrahimt471

    hmmm does certbot renew --dry-run (or ur tools equivalent) succeed? ?

    thinking

    11 2 helpful
  5. Joon B.
    @proxyfox

    make a backup before u touch the fan curve, learned that the hard way

    1 0 helpful
  6. Amara Kowalski
    @amara.kowalski

    oof ERR_CERT_AUTHORITY_INVALID on some devices but not others usually means a missing intermediate certificate. Configure the server with the full chain (fullchain.pem with Certbot, not cert.pem).

    4 2 helpful
  7. Nell W.
    @nellw286

    honestly just reset the firmware and save yourself the pain

    3 3 helpful
  8. Tess Olsen
    @tolsen

    been there man bump. still happening with clients for me

    6 0 helpful
  9. Juno
    @tensornomad

    oof set up independent monitoring. many uptime services can alert when a certificate is within a set number of days of expiry, its the safety net for when automation fails silently, which it eventually will. good luck man!

    2 0 helpful
  11. Greta L.
    @thread_ranger

    ok so exact same thing happened to my old thinkpad last month good luck man!

    0 4 helpful
  14. Zora W.
    @nimbus_garage384

    been there man renewal can succeed while teh browser still sees the old cert, cuz teh web server loaded teh certificate at startup and never reloaded... add a deploy hook: certbot renew --deploy-hook "systemctl reload nginx" (or apache2), containers need teh same: reload or restart teh proxy after renewal. hope that helps :)

    1 1 helpful
  15. Nell W.
    @nellw286

    ERR_CERT_COMMON_NAME_INVALID or SSL_ERROR_BAD_CERT_DOMAIN means the certificate doesn't list the hostname you visited. Often the www name or a new subdomain wasn't included, or the server falls back to the default site's cert because the virtual host for this name doesn't match. Reissue with all names, and check server_name or teh vhosts ServerName. worked for me anyway 🤷

    2 1 helpful
  16. Tess Olsen
    @tolsen

    @nimbus_garage384 what did u end up doing in the end ??

    2 0 helpful
  17. Amara Kowalski
    @amara.kowalski

    wait what idk man that sounds like bad advice tbh

    lol

    2 1 helpful
  19. Theo R.
    @theo.reid

    hmmm following, having teh same problem. told my boss it would take 10 minutes. its been a whole week fingers crossed 🤞

    3 0 helpful

Reply to this topic

Sign in or create an account to reply.