Let's Encrypt Renewal Failed: Why It Happens and How to Fix It
A Let's Encrypt certificate lasts 90 days, so a broken renewal surfaces as an expired-certificate warning weeks later. Here are the usual causes and the commands to find yours.
Short answer: Let's Encrypt certificates last 90 days and certbot tries to renew them once 30 days or fewer remain. A renewal fails when Let's Encrypt cannot confirm you control the domain: DNS no longer points at the server, port 80 is blocked, the web server no longer serves the challenge folder, or a rate limit has been hit. Run certbot renew --dry-run; the error names the cause.
First, see what you have
# list certificates, their names and expiry dates
sudo certbot certificates
# rehearse a renewal without changing anything
sudo certbot renew --dry-run
# is the automatic renewal timer actually scheduled?
systemctl list-timers | grep -i certbotLet's Encrypt stopped sending expiry reminder emails in 2025. If renewal breaks, nothing warns you unless you monitor the certificate yourself.
The usual causes
| Error mentions | Cause | Fix |
|---|---|---|
| DNS problem / NXDOMAIN | The domain or www record was deleted or moved | Point the A record back at this server, or remove that name from the certificate |
| Connection refused / timeout on port 80 | Firewall or security group closes port 80 | Open port 80; the HTTP challenge needs it even if the site is HTTPS-only |
| 404 on /.well-known/acme-challenge/ | A redirect or rewrite rule swallows the challenge path | Exclude /.well-known/acme-challenge/ from redirects and rewrites |
| Unauthorized / wrong IP | DNS points at a CDN, old server or parked page | Point DNS at this server, or use the DNS-01 challenge |
| too many certificates already issued | Duplicate Certificate limit (5 per week for the same names) | Wait out the week; fix the cause before retrying |
| Renewal never ran | Timer or cron job missing after a reinstall | Re-enable certbot.timer or add a cron entry |
After it renews
The new certificate is only used once the web server reloads. certbot normally does this through a deploy hook; if yours does not, add one, otherwise visitors keep seeing the old, expiring certificate.
# check the certificate actually being served, not the file on disk
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -datesOn GHP Cloud
Certificates are issued when a site is created and renewed automatically well ahead of expiry. If issuance fails because DNS is not pointed yet, GHP keeps retrying, and it monitors the certificate each site is actually serving, so you hear about a problem before visitors see a warning.
Frequently asked questions
How long does a Let's Encrypt certificate last?
90 days. Let's Encrypt has announced plans to shorten this further, which makes automatic renewal essential.
Can I renew a Let's Encrypt certificate manually?
Yes: sudo certbot renew, or certbot renew --cert-name example.com for one certificate. Fix the underlying cause first, or it fails again in 60 days.
Does Cloudflare break Let's Encrypt renewal?
Usually not; the HTTP challenge passes through Cloudflare's proxy. It fails if a Cloudflare rule blocks or rewrites /.well-known/acme-challenge/.
GHP Team
GHP Cloud
Manage WordPress sites the smart way
GHP Cloud gives you a managed server in India with a firewall, malware scanning and daily backups, billed in INR with a GST invoice — from ₹1,450/month.