How to Fix a Let's Encrypt Certificate That Stopped Renewing

Let's Encrypt certificates last 90 days. certbot renews them on a schedule through a systemd timer or a cron job, so an expired certificate means that schedule broke somewhere.

Check the certificate and run a dry run

sudo certbot certificates
sudo certbot renew --dry-run

The first command lists each certificate and its expiry date. The second attempts a renewal without saving anything and prints the exact error.

Match the error to its cause

• Connection refused or timeout on port 80. The HTTP-01 challenge needs port 80 open from the internet. Check the firewall (sudo ufw status) and any cloud security group.
• 404 on /.well-known/acme-challenge/. The webroot path changed. Confirm the path in /etc/letsencrypt/renewal/yourdomain.com.conf matches the site's document root.
• DNS problem or unexpected IP. The domain no longer points at this server. Check with dig A yourdomain.com.
• Site behind Cloudflare proxy. Challenges reach Cloudflare instead of your server. Switch to the DNS-01 challenge with the Cloudflare plugin, or install a Cloudflare origin certificate and let Cloudflare serve the public one.
• ACME v1 or unsupported client. Old certbot versions cannot talk to the current API. Replace the OS package with the snap:

sudo apt remove certbot
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Confirm the renewal timer is running

systemctl list-timers | grep certbot
systemctl status certbot.timer

If nothing appears, enable it:

sudo systemctl enable --now certbot.timer

On cron-based installs, check that /etc/cron.d/certbot exists and cron is running.

Force a renewal now

sudo certbot renew

certbot skips certificates with more than 30 days left. Add --force-renewal only if a fresh certificate is needed today.

Reload the web server

A new certificate on disk does nothing until the server reloads it.

sudo systemctl reload nginx

For Apache, use sudo systemctl reload apache2 on Debian and Ubuntu, or httpd on the RHEL family. Then load the site in a browser and check the expiry date in the padlock details.

If the site is on a managed host. Vercel, Netlify, and cPanel AutoSSL renew certificates on their own. When renewal fails there, the cause is almost always DNS not pointing at the host; fix the A or CNAME record and the host retries.

If you want warning next time. Set a calendar reminder at day 60, or use a free uptime monitor with certificate expiry alerts.