Blog

Renewal automation fails silently more often than it fails loudly: the cron exits zero, the logs say success, and the server keeps serving the old certificate. Why it happens and how to catch it.

Certbot exited 0. Disk has a fresh fullchain.pem. openssl on :443 still shows last month's notAfter. Five failure modes, each with one command.

Eight ways to monitor SSL certificate expiry — from a cron one-liner to Prometheus to paid SaaS — compared on the criterion that actually matters: do they check the certificate your server really serves?

Certbot wrote a new fullchain.pem and exited 0. openssl on :443 still shows last month's notAfter. Prove disk vs wire, reload nginx, add a deploy hook.

Certbot needs /.well-known/acme-challenge/ on port 80. A blanket HTTP-to-HTTPS redirect or auth wall returns 404 or unauthorized. Prove the path, carve an exception, renew, then watch expiry off-box.

certbot.timer inactive, masked, or never installed. No renew runs. The leaf on :443 ages until a browser warns. Prove the timer, enable it, then watch expiry off-box.

Certbot has been logging renewal errors for weeks. The notices went to root on a server with no mail relay — or to a journal nobody reads. How to find the errors, read what went wrong, and route alerts somewhere that reaches you.

Let's Encrypt refused the renewal because something already burned the quota. How to read which limit you hit, find the loop that spent it, and get a certificate back on the wire without waiting a week.

We read the live certificate served by each of the 10,000 most-visited sites. 85 are serving one a browser rejects outright, and the rate holds as you scan deeper.

31 August, 19:05 CET: Exchange, Teams and SharePoint fail on an expired certificate. 5 September: a homelab wildcard expires after 3 days of failed renewals nobody saw. The same failure, and what we shipped today so the CA tells you before a user does.