NODELOG by THIVELAB
Subscribe
Home/Engineer/Troubleshooting/Fixing SSL Certificate Expir…
TroubleshootingBeginnerUbuntuDebianSSLcertbotLet's Encrypt

Fixing SSL Certificate Expiry and certbot renew Failures: Port 80, DNS, Rate Limits, and Nginx Reloads

A step-by-step guide to resolving Let's Encrypt SSL certificate renewal errors, including NET::ERR_CERT_DATE_INVALID, certbot renew failures, a blocked port 80, and Nginx reload failures.

NONodelogUpdated 0 views
Contents
  1. Check the current certificate expiration date
  2. Try renewing immediately
  3. Cause 1 — Port 80 is blocked
  4. Cause 2 — Nginx/Apache config errors causing the plugin to fail
  5. Cause 3 — Domain DNS does not point at the server
  6. Cause 4 — Rate limit exceeded
  7. Verify automatic renewal
  8. Apply the renewal in Nginx

If the browser shows NET::ERR_CERT_DATE_INVALID or Your connection is not private, the SSL certificate has expired.

Check the current certificate expiration date

Bash
# Check domain certificate expiration date (from outside)
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

# List local certbot certificates
sudo certbot certificates

Try renewing immediately

Bash
sudo certbot renew --dry-run    # Test (does not actually renew)
sudo certbot renew              # Actual renewal

On success:

CODE
Congratulations, all renewals succeeded

On failure, check the causes below one by one.

Cause 1 — Port 80 is blocked

Let's Encrypt requires port 80 to be open for the HTTP-01 challenge.

Bash
# Check whether port 80 is listening
sudo ss -tlnp | grep :80

# Check UFW firewall
sudo ufw status | grep 80

# Allow it if it is not open
sudo ufw allow http
Bash
# Confirm Nginx is running (standalone mode requires it to be stopped)
sudo systemctl status nginx

Cause 2 — Nginx/Apache config errors causing the plugin to fail

Bash
# Validate Nginx configuration
sudo nginx -t

# Specify the web server plugin on renewal
sudo certbot renew --nginx       # When using Nginx
sudo certbot renew --apache      # When using Apache

# Standalone mode (briefly stop the web server)
sudo systemctl stop nginx
sudo certbot renew --standalone
sudo systemctl start nginx

Cause 3 — Domain DNS does not point at the server

Bash
# Check whether the domain points at this server's IP
dig +short example.com
curl -s ifconfig.me   # Server public IP

If the two values differ, the DNS configuration is wrong. If DNS is correct, wait for propagation (up to 48 hours) and retry.

Cause 4 — Rate limit exceeded

Let's Encrypt limits issuance to 5 times per week per domain.

Bash
# Check the renewal log
sudo tail -50 /var/log/letsencrypt/letsencrypt.log | grep -i "rate|limit"

If you hit the rate limit, wait 7 days and retry, or test against the staging server:

Bash
sudo certbot renew --dry-run --staging

Verify automatic renewal

Bash
# Check the auto-renewal timer status
sudo systemctl status certbot.timer
sudo systemctl list-timers | grep certbot

# If the timer is missing, check cron
sudo crontab -l | grep certbot
cat /etc/cron.d/certbot
Bash
# Add an auto-renewal cron job if none exists
echo "0 3 * * * root certbot renew --quiet" | sudo tee /etc/cron.d/certbot

Apply the renewal in Nginx

Bash
sudo nginx -t && sudo systemctl reload nginx

The browser cache may still show the old certificate after renewal. Hard-refresh with Ctrl+Shift+R, or check in a private/incognito window.

#SSL#certbot#Let's Encrypt#Troubleshooting#HTTPS#Nginx
Editorial note

AI tools may assist drafting. Check the evidence in each guide for whether commands were run and which environment was used. Confirm the current docs for your version before applying instructions, and email us about errors. email us

Topic-related official docs (auto-linked · not per-claim sources)NGINX documentation ↗OpenSSL documentation ↗
How we write and review →Editorial policy →

Questions & answers

Ask a question about this guide. We'll review and reply.