Fix: SSL/TLS Certificate Expired

!Symptoms

• Browser shows 'Your connection is not private' or NET::ERR_CERT_DATE_INVALID
• curl fails with 'SSL certificate problem: certificate has expired'
• API clients fail with SSL verification errors
• Monitoring alerts for certificate expiry

?Root Causes

• Let's Encrypt or other CA certificate auto-renewal failed silently
• Certbot renewal cron job is not running or broken
• Nginx was not reloaded after certificate renewal
• Certificate was manually provisioned and renewal was forgotten
• Intermediate CA certificate in the chain has expired

#Diagnosis Steps

1. 1Check certificate expiry: `echo | openssl s_client -connect domain.com:443 2>/dev/null | openssl x509 -noout -dates`
2. 2Check certbot renewal status: `certbot certificates`
3. 3Check certbot renewal logs: `cat /var/log/letsencrypt/letsencrypt.log`
4. 4Verify the certificate chain: `openssl s_client -connect domain.com:443 -showcerts`
5. 5Check if Nginx is using the latest cert: `nginx -T | grep ssl_certificate`

>Fix

1. 1Renew immediately: `certbot renew --force-renewal`
2. 2Reload Nginx to pick up new certs: `systemctl reload nginx`
3. 3If certbot fails, try standalone mode: `certbot certonly --standalone -d domain.com`
4. 4Update the certificate chain file if the intermediate CA expired
5. 5For self-signed certs: `openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem`

*Prevention

• Set up certbot auto-renewal cron: `0 3 * * * certbot renew --quiet --deploy-hook "systemctl reload nginx"`
• Monitor certificate expiry with external tools (UptimeRobot, Datadog, cert-manager)
• Use cert-manager in Kubernetes for automated certificate lifecycle
• Set up alerts at 30, 14, and 7 days before expiry
• Test renewal in staging: `certbot renew --dry-run`

Related Error Messages