Check Certificate Renewal

When to use it

After setting up HTTPS, after changing nginx or DNS, and whenever you want proof that renewal will work before a certificate gets close to expiring. It changes nothing on the server.

Choosing the options

Certificate — the certificate's first domain, for example shop.example.com. Leave it empty to check every certificate on the server.

What it checks

1. A Certbot renewal timer is running and has a next run scheduled.
2. The nginx reload hook is installed and executable, so a renewed certificate is served without waiting for nginx to restart.
3. For each certificate, a renewal dry run against Let's Encrypt's staging environment (certbot renew --dry-run). This is a real validation through port 80, with nothing saved.
4. Port 443 serves the same certificate Certbot manages, and the run reports its expiry date. A certificate with less than 30 days left is noted.

After the run

A passing run means renewal will happen by itself. If a check fails, the message names the fix, usually running Configure Certificate Renewal.

Common problems

"No Certbot renewal timer is running, so certificates would expire." — Run Configure Certificate Renewal.

"… is missing, so a renewed certificate would not be served until nginx next restarted." — The reload hook is missing. Run Configure Certificate Renewal.

"A renewal dry run for … failed (above)" — Let's Encrypt could not validate the domain now. The domain may no longer point at this server, port 80 may be blocked, or the nginx site may have been changed. The output above shows the reason.

"Port 443 serves a different certificate for … than the one Certbot manages" — nginx has not loaded the renewed certificate, or another site answers for this name. Reload nginx with Restart Services (Reload), and check for duplicate sites.

"There is no certificate named … on this server." — Check the name with certbot certificates on the server; use the certificate's first domain.