Let's Encrypt certificates last 90 days, and Certbot is meant to renew them automatically. Most of the time it does. When it doesn't, nothing tells you: Let's Encrypt stopped sending expiry reminder emails in June 2025, so a broken renewal now shows up as a browser warning in front of your visitors. This guide shows how to confirm renewal really works.
How Certbot renews
When you install Certbot, it adds a scheduled job that runs twice a day: a systemd timer (certbot.timer, or snap.certbot.renew.timer for the snap package) or a cron entry in /etc/cron.d/certbot. Each run renews any certificate that's due, normally when 30 days or fewer are left, and leaves the rest alone.
Check the timer is there and active:
systemctl list-timers | grep -i certbot
See every certificate Certbot manages and when it expires:
sudo certbot certificates
Test renewal without waiting
A dry run goes through the whole renewal against Let's Encrypt's staging service, without replacing your certificates or counting against rate limits:
sudo certbot renew --dry-run
If it ends with "Congratulations, all simulated renewals succeeded", renewal works today. Run it again after any change to DNS, firewalls, load balancers or the web server configuration; those changes are what usually break renewals.
Why renewals fail (and the fix)
| Error or symptom | Usual cause | Fix |
|---|---|---|
Timeout during connect / Connection refused |
Port 80 is blocked by a firewall or security group | Allow inbound port 80; the HTTP-01 challenge needs it even if the site only serves HTTPS |
Invalid response from http://…/.well-known/acme-challenge/ (404) |
The web server doesn't serve the challenge files: changed web root, a rewrite rule or a redirect to an app | Exclude /.well-known/acme-challenge/ from redirects and rewrites, or re-run with the correct --webroot-path |
| Validation fails only sometimes | An AAAA (IPv6) record points to a server that doesn't answer. Let's Encrypt tries IPv6 when it exists | Fix or remove the AAAA record |
DNS problem: NXDOMAIN |
The domain or subdomain no longer resolves | Restore the DNS record, or remove the name from the certificate |
too many certificates already issued |
Let's Encrypt rate limits after repeated attempts | Test with --dry-run first; wait for the limit to reset |
| Renewed, but visitors still see the old certificate | The web server was never reloaded | Add a deploy hook (below) |
Details are in Certbot's log: sudo less /var/log/letsencrypt/letsencrypt.log.
Reload the server after every renewal
A renewed certificate is only used once the web server reloads it. Certbot's --nginx and --apache plugins reload automatically, but with --webroot, --standalone or DNS plugins you need a deploy hook, a script Certbot runs only after a successful renewal:
sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-web.sh <<'EOF'
#!/bin/sh
systemctl reload nginx
EOF
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-web.sh
Use systemctl reload apache2 (Debian and Ubuntu) or systemctl reload httpd (RHEL) for Apache. If the certificate is also used elsewhere, such as a mail server, a load balancer or another machine, copy it there in the same script.
Wildcards and servers that aren't public
Wildcard certificates (*.example.com) and hosts that the internet can't reach need DNS validation. Install the Certbot DNS plugin for your DNS provider (for example certbot-dns-cloudflare or certbot-dns-route53) so renewals can create the validation record automatically. Manual DNS validation (--manual) can't renew on its own.
Check from the outside
certbot renew reports what Certbot did. It can't tell you whether visitors get the new certificate: a server that wasn't reloaded, a CDN or load balancer with its own copy, or a second server behind the same name all keep serving the old one.
Confirm with the SSL checker, or let CertHalo check for you: it emails you before a certificate expires and the moment a renewal goes live, so a renewal that silently failed can't surprise you. Monitor 3 certificates free.
Related: How to check an SSL certificate's expiry date · Preparing for 47-day certificates