How to Force Renewal of an Expired Let's Encrypt SSL Certificate with Certbot

✨ Quick Answer

The expired SSL certificate error when accessing your website, despite using Let's Encrypt's Certbot, typically occurs because the automatic renewal service failed silently due to port 80 being blocked by your conflicting web server, or due to changes in your DNS records.

Quick Diagnostics

Cause

Expired Let's Encrypt SSL/TLS certificate due to failed renewal

Solution

Force certificate renewal: sudo certbot renew --force-renewal

Cause

Failed HTTP-01 challenge because port 80 is closed

Solution

Ensure web server listens on port 80 and restart Nginx/Apache

The expired SSL certificate error when accessing your website, despite using Let's Encrypt's Certbot, typically occurs because the automatic renewal service failed silently due to port 80 being blocked by your conflicting web server, or due to changes in your DNS records.

Step-by-Step Solution

1. 1

   Step 1: Identificar y liberar puertos bloqueados

   Let's Encrypt uses the HTTP-01 challenge to verify that you own the domain, which requires free access on port 80. Temporarily stop the conflicting web server:

   BASH Copy

   # Si utilizas Nginx
   sudo systemctl stop nginx
   
   # Si utilizas Apache
   sudo systemctl stop apache2
   

2. 2

   Step 2: Ejecutar la renovación forzada de Certbot

   Start the forced manual renewal to ignore previous expiration cache policies:

   BASH Copy

   # Forzar la renovación en consola
   sudo certbot renew --force-renewal
   

   (Verify that the console returns a success message: Congratulations, all renewals succeeded).

3. 3

   Step 3: Volver a iniciar los servidores web y verificar

   Restart your production services to apply the new cryptographic keys:

   BASH Copy

   sudo systemctl start nginx
   sudo systemctl start apache2