Let’s Encrypt cert did not renew on my Droplet, site shows expired certificate

Question

Hi, I set up HTTPS with Certbot and Nginx on a Droplet about 3 months ago. Today my site shows “certificate expired” in the browser. I never touched anything after the setup. Why did the auto renewal not work, and how do I fix it now?

Bobby · Answer

Hi there, Certbot should renew on its own, so something broke the renewal. First, run a dry test. It shows the real error without changing anything: sudo certbot renew --dry-run Read the output. The most common causes are: Port 80 is blocked or used by something else. The HTTP challenge needs port 80. Check your Cloud Firewall and ufw status, and make sure Nginx listens on 80 and does not redirect the /.well-known/acme-challenge/ path to somewhere broken. The renewal timer is not running. Check it with: systemctl list-timers | grep certbot sudo systemctl status certbot.timer If the timer is missing, enable it with sudo systemctl enable --now certbot.timer. DNS changed. If the domain no longer points to this Droplet (new IP, or a proxy like Cloudflare in front), the challenge fails. Config error in Nginx. Run sudo nginx -t. A broken config can stop the reload step. Once the dry run works, renew right now: sudo certbot renew sudo systemctl reload nginx If the browser still shows the old cert after that, check which cert Nginx really uses: sudo certbot certificates grep ssl_certificate /etc/nginx/sites-enabled/* The paths in the Nginx config should point to /etc/letsencrypt/live/yourdomain/. Sometimes there are two server blocks and the other one still has an old cert. To not be surprised again, add a simple check: echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -enddate Run it from a cron job or use an uptime monitor that warns you 14 days before expiry. Also, if you don’t want to manage certs yourself, put the site behind a DigitalOcean Load Balancer or App Platform, which handle the certificate for you.

alexdo · Answer

Hi there, One more cause to rule out, since it matches “I never touched anything” closely: the certificate may actually have renewed, but Nginx never reloaded, so it kept serving the old one from memory. Whether Certbot reloads Nginx after renewing depends on how the certificate was first issued. If you used certbot --nginx, the Nginx plugin handles the reload. If you used certbot certonly --webroot or --standalone, nothing tells Nginx to pick up the new files. You can see which method your certificate uses here: sudo grep -E 'authenticator|installer' /etc/letsencrypt/renewal/*.conf If sudo certbot certificates shows a future expiry date while the browser still shows the old one, this is the cause. The fix is a deploy hook, which Certbot runs after every successful renewal: echo -e '#!/bin/sh
systemctl reload nginx' | sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh The standalone method has a second problem worth knowing about. It starts its own temporary web server on port 80, which fails while Nginx is already using that port. If your renewal config shows authenticator = standalone, switching to the nginx or webroot method avoids that on future renewals. On the “why didn’t I get a warning” part: Let’s Encrypt stopped sending expiry reminder emails in June 2025. Older setups that relied on those emails no longer get any notice, which makes the expiry check Bobby suggested more important than it used to be. Regards

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

Let’s Encrypt cert did not renew on my Droplet, site shows expired certificate

Related questions

How to setup ssl for Spaces CDN

ssl error on my website with cloundpannel

Report this

Let’s Encrypt cert did not renew on my Droplet, site shows expired certificate

Related questions

How to setup ssl for Spaces CDN

ssl error on my website with cloundpannel