Can a renewed certificate still look expired to users?

Yes. The new certificate may not be loaded by the web server yet, or an upstream load balancer may still be serving the old one.

What commonly breaks Let's Encrypt auto-renewal?

Blocked port 80, broken DNS validation, disabled cron or timers, and file permission problems are common operational causes.

Can a port issue look like an SSL expiry issue?

Yes. If port 443 is unreachable, the connection fails before the certificate can even be read, so users may interpret it as an SSL problem.

SSL Expiry Operations Checklist

An operations checklist for expiring or expired certificates, covering renewal automation, deployment verification, and HTTPS reachability checks.

Diagnose your site now

Problem

Your SSL certificate is close to expiring or has already expired, causing browser warnings, API failures, or monitoring alerts. Renewing the certificate alone is not enough if the updated certificate is not actually being served.

Symptoms

SSL Check shows an expired certificate or very little time remaining.
Browsers or clients report security warnings or TLS failures.
The certificate was renewed, but some environments still show the old expiry date.
HTTP works while HTTPS still fails.

Top 3 Causes

Renewal automation failed - Cron, timer, or ACME validation problems prevented renewal.
Deployment did not switch over - The new certificate exists, but the web server, proxy, or load balancer still serves the old one.
HTTPS path is broken - Port 443, load balancer routing, or proxy behavior prevents successful TLS negotiation.

Diagnose with DechoNet

SSL Check to inspect expiry, SAN coverage, and chain status.
HTTP Check to verify HTTPS redirects and final response behavior.
Port Check to confirm that port 443 is reachable externally.

Resolution Checklist

Confirm that certificate issuance or renewal actually succeeded in your ACME logs or provider console.
Run certbot renew --dry-run or the equivalent renewal test for your certificate stack.
Verify that your web server, reverse proxy, or load balancer points to the new certificate files.
Reload or roll the service after renewal so the active process serves the new certificate.
Re-run Port Check and HTTP Check to verify that HTTPS is reachable end to end.

When to Escalate

Escalate to the cloud or hosting provider if you use managed certificates.
Escalate to infrastructure operators if you cannot identify whether the old certificate is on the load balancer or origin.
Escalate quickly if issuance is blocked by CA errors or ACME rate limits.