Automatic renewal works most of the time. When it stops, the old certificate keeps working right up to its expiry date, so nothing looks wrong until then. These are the usual reasons, and what to check for each.
The renewal job stops
Automatic renewal is a scheduled job: a certbot timer, an acme.sh cron entry, or a task in your hosting panel. It stops when:
- the server is rebuilt or upgraded, and the timer isn't set up again;
- the renewal client is updated and its configuration changes;
- a password or API key the job uses is rotated or expires;
- the disk is full, or a permission changes on the certificate folder;
- renewals fail and the error goes to a log file or a mailbox nobody reads.
The server moved
A site moves to a new server or a new host, and the renewal setup stays behind. The old server may keep renewing a certificate nobody uses. The new one serves a certificate that was copied over by hand, and it runs out on its own date.
Renewed, but not served
Many sites have something in front of the web server: a load balancer, a CDN or a reverse proxy. Each of them holds its own copy of the certificate. The renewal job updates the file on the web server, while the load balancer or CDN keeps serving the old certificate to every visitor.
The same happens on a single server when the web server isn't reloaded after a renewal. The new file is on disk; the running server still uses the old one.
A DNS change broke validation
Before every renewal, the certificate authority checks that you still control the name.
- HTTP validation needs the name to point at the server that runs the renewal. Move the name to a CDN or a new host, and the check lands somewhere else.
- DNS validation needs API access to your DNS provider. Move to a new provider or change the API key, and the job can't publish its record.
- A CAA record lists which certificate authorities may issue for your domain. Switch provider without updating it, and issuance is refused.
As certificate lifetimes get shorter, this check runs more often. Certificate lifetimes are getting shorter has the dates.
What to check
- For each certificate, write down where it's renewed: which server, which service, which account.
- See when the renewal job last succeeded, and send its errors to a mailbox someone reads.
- Make sure the web server reloads after a renewal.
- Make sure every load balancer, CDN and proxy in front of the site gets the new certificate.
- After a server move or a DNS change, run one renewal test by hand (with certbot:
certbot renew --dry-run). - Look at the certificate from outside, the way visitors see it. The file on the server tells you what should be served; the free certificate check tells you what is.
Where monitoring fits
SSL Monitor reads the certificate each host serves, every day, from outside. That covers every case above, including a certificate that renewed fine but never reached the server your visitors connect to. You get an e-mail while there's time to fix it.
SSL Monitor warns you. The renewal itself stays with your server, your host or your certificate provider.