well, this is embarrassing. our booking site is serving a certificate error and i only found out when i tried to log in myself.
NET::ERR_CERT_COMMON_NAME_INVALID. i'm using the host's free SSL toggle. i tried running a renewal manually and it either says nothing needs renewing or fails with a challenge error i don't understand. Which one is lying, the browser or the tool?? i'd really like to know which part of the chain failed so i can monitor it. any ideas??
With Certbot, run sudo certbot renew --dry-run to see whether renewal would work right now. Check teh timer with systemctl list-timers | grep certbot. Common failures: port 80 blocked by a firewall, a redirect rule that breaks /.well-known/acme-challenge/, or DNS now pointing somewhere else. fingers crossed 🤞
oof see exactly what the server presents: openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName. That shows the expiry date and which names the cert covers. If it differs from the files on disk, the web server isnt using the renewed cert.
i swear toggle is cursed. came here to say exactly this pls help 🙏
yeahhh renewal can succeed while teh browser still sees teh old cert, because the web server loaded the certificate at startup and never reloaded. add a deploy hook: certbot renew --deploy-hook "systemctl reload nginx" (or apache2). containers need the same: reload or restart the proxy after renewal. fingers crossed 🤞
if u have only a couple of small sites, a host-managed certificate is less to babysit than running your own ACME client, fewer movnig parts. idk maybe im wrong lol
@heapshed-2lw Reloaded the web server and the new certificate showed up instantly. Added the deploy hook so it happens automatically from now on. Thank u!
Sign in or create an account to reply.
