How to Force Renewal of an Expired Let's Encrypt SSL Certificate with Certbot

🚀 Cómo solucionar el error paso a paso

Paso 1: Identificar y liberar puertos bloqueados

Let's Encrypt uses the HTTP-01 challenge to verify that you own the domain, which requires free access on port 80. Temporarily stop the conflicting web server:

# Si utilizas Nginx
sudo systemctl stop nginx

# Si utilizas Apache
sudo systemctl stop apache2

Paso 2: Ejecutar la renovación forzada de Certbot

Start the forced manual renewal to ignore previous expiration cache policies:

# Forzar la renovación en consola
sudo certbot renew --force-renewal

(Verify that the console returns a success message: Congratulations, all renewals succeeded).

Paso 3: Volver a iniciar los servidores web y verificar

Restart your production services to apply the new cryptographic keys:

sudo systemctl start nginx
sudo systemctl start apache2

🛡️ Consejo de Prevención

Recommended security practices:

• Do not rely solely on periodic manual renewals for the security of your sites. Make sure to verify that Certbot's internal automatic renewal timer is active in the system, which will validate the certificate status twice a day:
  BASH Copy

  # Verificar el estado del temporizador systemd
  systemctl list-timers | grep certbot
  

  If HTTP challenges on port 80 regularly fail due to corporate security firewalls, migrate your validation process to the DNS-01 challenge using the corresponding APIs of your DNS provider (Cloudflare, Route53, etc.).