How does an auto-renewing certificate just... expire on our staging server??

wait what expiry date does openssl s_client show for the live certificate?

sorry forgot to say the dry run fails on the HTTP challenge, we added a firewall rule recently that only allows 443. idk what else to say tbh

hmmm renewal can succeed while teh browser still sees the old cert, because the web server loaded the certificate at startup and never reloaded. Add a deploy hook: certbot renew --deploy-hook "systemctl reload nginx" (or apache2). containers need the same: reload or restart the proxy after renewal.

been there man with Certbot, run sudo certbot renew --dry-run to see whether renewal would work right now. check the timer with systemctl list-timers | grep certbot... common failures: port 80 blocked by a firewall, a redirect rule that breaks /.well-known/acme-challenge/, or DNS now pointing somewhere else. hope that helps :)

oh also mods can we pin this thread

pro tip: write down what u change. i didnt and had to redo server from scratch

oh ive been there lol ERR_CERT_AUTHORITY_INVALID on some devices but not otehrs usually means a missing intermediate ceritficate. Configure the server with the full chain (fullchain.pem with Certbot, not cert.pem).

yesss ok update: did what @bivanova_25 said and its fine now cant believe it was that simple lol

ok so for me it was the DNS... swapped it and boom, fixed good luck man!

See exactly what the server presents: openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName. That shows the expiry date and which names teh cert covers. If it differs from the files on disk, the web server isn't using the renewed cert. good luck man!

ERR_CERT_COMMON_NAME_INVALID or SSL_ERROR_BAD_CERT_DOMAIN means the certificate doesnt list teh hostname you visited 🤦 Often teh www name or a new subdomain wasnt included, or the server falls back to teh default sites cert cuz the virtual host for this name doesnt match. Reissue with all names, and check server_name or the vhosts ServerName.

if u prefer video, this one is solid:

▶ How to Fix the NET::ERR_CERT_DATE_INVALID Error: 7 Proven Solutions

lol same thing happened to me make a backup before u touch the cable, learned that the hard way good luck man!

lol same thing happened to me make a backup before u touch the settings, learend that the hard way

so annoyed rn i swear certificate is cursed seriously need help here 😭

set up independent monitoring. many uptime services can alert when a certificate is within a set number of days of expiry. its teh safety net for when automation fails silently, which it eventually will. good luck man!

Id consider switching to the DNS challenge. It doesnt need port 80 open and works for wildcard certs, though it requires API access to your DNS provider.