Quick answer
SSL certificates renew automatically when automatic renewal is set up (cron job or systemd timer), while commercial certificates are renewed manually before the expiration date. Check the expiration date with `openssl x509 -enddate -noout -in certificate.crt`, set up automatic renewal, and monitor warnings. This prevents website downtime and browser warnings.
How to recognize the problem
- Browser shows a warning "Your connection is not private" or "Certificate has expired"
- Users cannot access the website or a security error is displayed
- HTTPS connection is interrupted or the browser does not allow continuing
- Monitoring tools report that the certificate has expired
- Certificate expiration emails arrive from the certificate authority
Most common causes
Automatic renewal is not set up
Let's Encrypt certificates are valid for 90 days and automatic renewal is recommended. If the cron job or systemd timer is not active, the certificate will expire.
Cron job for renewal is not working
The job may be misconfigured, lack permissions, or run in the wrong environment, so renewal does not happen.
Manual management of a commercial certificate
Commercial certificates have a limited validity period (according to current rules, at most 200 days) and are usually renewed manually. Without a reminder, the expiration date is easily missed.
Server configuration change
After a website migration or web server change, certificate paths or the renewal method may be incorrect.
Incorrect system time
The server may report expiration earlier due to incorrect system time. Check that the time is accurate.
Step-by-step fix
- 1
Check the certificate expiration date
Run
openssl x509 -enddate -noout -in /path/to/certificate.crtto see the exact date. Alternatively, in the browser click the padlock next to the address and view the certificate details. Note the date and compare it with the current date. - 2
Check if automatic renewal is active
For Let's Encrypt with certbot, run
sudo certbot renew --dry-run. If the output is successful, renewal works. Otherwise, check cron jobs (for example withsudo crontab -l) or systemd timers withsystemctl list-timers. - 3
Renew the certificate manually
If the certificate has expired, run
sudo certbot renew. If that fails, runsudo certbot certonly --force-renewal -d yourdomain.com; use--force-renewalonly when necessary due to rate limits. For a commercial certificate, download a new one from the issuer, back up the old file, and replace it. - 4
Reload the web server
After renewal, apply the changes:
sudo systemctl reload nginxorsudo systemctl reload apache2. Verify that the website works over HTTPS again. - 5
Set up automatic renewal
If you use Let's Encrypt, use only one automatic renewal mechanism. For cron, check that a job is active in root's crontab, for example:
0 3 * * * /usr/bin/certbot renew --quiet(adjust the path to certbot). For systemd, check thatcertbot.timeris active withsystemctl status certbot.timerand do not use cron at the same time. - 6
Test renewal
Run
sudo certbot renew --dry-runto simulate renewal without actually issuing a certificate. Make sure there are no authentication or permission errors. - 7
Set up expiration monitoring
Use a tool such as
ssl-cert-checkor an external monitoring service. Set alerts at least 14 days before expiration. Regularly check emails from the certificate authority.
If nothing helps
If the certificate does not renew even after manual triggering, check the logs: sudo journalctl -u certbot.service or /var/log/letsencrypt/letsencrypt.log. Common errors are failed HTTP authentication (for the HTTP-01 challenge, port 80 must be reachable), incorrect webroot directory path, or missing permissions. For commercial certificates, check that you have installed the intermediate certificate (CA bundle). If the website is in production and must not be down, consider temporarily using a free certificate until you resolve the issue. Always back up the configuration before making changes.
How to prevent it
- Regularly check the certificate expiration date and set reminders
- Enable automatic renewal and test it once a month
- Monitor emails from the certificate authority and do not ignore warnings
- Use a monitoring tool that will notify you before expiration
When to call a professional
If you are not sure how to set up automatic renewal or you encounter renewal errors that you cannot resolve, consult an IT expert. Also, if the website has high traffic and must not be down, it is better to leave renewal to professionals.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
How often should an SSL certificate be renewed?
Let's Encrypt certificates are valid for 90 days and automatic renewal is recommended. Commercial certificates today are typically valid for much less than a year (according to current rules, at most 200 days), and the exact term depends on the issuer. Always check the expiration date and set up automatic renewal where possible.
What happens if the certificate expires?
Browsers will show a warning that the connection is not secure, and users may abandon the visit. With HSTS or stricter security policies, access may be completely blocked, which affects the website's security and reputation.
How do I know the renewal was successful?
After renewal, check the new expiration date using `openssl x509 -enddate -noout -in certificate.crt` or in the browser. Make sure the website works without warnings and that the web server has been reloaded.