[{"data":1,"prerenderedAt":200},["ShallowReactive",2],{"seo-verification":3,"blog-ssl-certificate-renewal-failed-diagnose-before-retrying-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-ssl-certificate-renewal-failed-diagnose-before-retrying-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":144,"ctaBody":145,"ctaButton":146,"ctaUrl":147,"relatedPosts":148},539,"ssl-certificate-renewal-failed-diagnose-before-retrying",{"fr":12,"en":10,"ar":13,"es":14},"certificat-ssl-renouvellement-echec-diagnostic-client","فشل-تجديد-شهادة-ssl-التشخيص-قبل-إعادة-المحاولة","renovacion-ssl-fallida-diagnosticar-antes-de-reintentar","SSL renewal failed: diagnose before you retry","Certificate expired despite automatic renewal? DNS, redirects, firewall, CAA, CDN proxy: the diagnostic tree and the commands to fix the cause.",11,0,false,"2026-10-30T00:00:00+00:00","2026-10-31T01:54:05+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fcertificat-ssl-renouvellement-echec-diagnostic-client-poster.svg","The browser shows a certificate warning, or a message says a renewal failed. The usual reflex is to conclude that automatic SSL is broken at the host and to retry issuance in a loop. In the vast majority of cases the mechanism works: a validation condition has changed, whether a DNS edit, a new redirect, an enabled firewall, a CAA record or a CDN proxy. This guide gives the diagnostic tree, the commands to read each signal, and where to retry once the cause is cleared.",[35,39,42,64,100,103,106,109,112,122,137,141],{"type":36,"title":37,"body":38},"h2","An expired certificate does not mean a broken host","A free certificate renews by itself, with nobody clicking anything. When it expires anyway, the spontaneous conclusion is that the automatic service has failed. That is rarely true. Renewal is not an action by the host: it is a dialogue between the certificate authority and your domain, repeated at every expiry, and it succeeds only if the domain answers the way it did the first time.\n\nBut a site changes over time. Someone switched DNS servers, added a redirect rule in the `.htaccess` file, enabled a web application firewall, put the domain behind a CDN or published a CAA record. Each of these moves is legitimate, and each can block validation while the site keeps displaying normally. The error shows up weeks later, at expiry, far from the change that caused it. Retrying issuance without fixing anything only produces the same failure. You need to read the signal, find the condition that moved, restore it, then retry once.",{"type":36,"title":40,"body":41},"What renewal checks at every expiry","To issue or renew a certificate, the authority must make sure that whoever asks controls the domain. It proceeds in four steps, and the failure is always in one of them.\n\nFirst, it resolves the name: DNS must answer and return the address of the right server, over IPv4 as well as IPv6. Then, with file validation, it requests `http:\u002F\u002Fyour-domain.com\u002F.well-known\u002Facme-challenge\u002F` on port 80 and expects the exact content placed by the ACME client. Third, it looks up the domain's CAA records to check that none forbids it from issuing. Finally, it follows any redirects, but rejects an error response or a blocking page.\n\nThis sequence explains the diagnostic tree: does the domain point to the right server, is the challenge reachable, does a redirect or a firewall intercept it, does a CAA record exclude the authority, is a proxy in a compatible mode. The next steps test these five points in that order.",{"type":43,"title":44,"steps":45},"steps","The diagnosis in six steps",[46,49,52,55,58,61],{"title":47,"body":48},"Read the real expiry date","Do not trust a message: read the certificate that is actually served. `openssl s_client -connect your-domain.com:443 -servername your-domain.com \u003C\u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | openssl x509 -noout -dates -issuer` prints the start and end dates and the issuer. If the end date has passed, renewal really failed. If it is still valid, the warning comes from elsewhere: another domain name that is not covered, or an incomplete chain.",{"title":50,"body":51},"Check where the domain points","`dig +short A your-domain.com` then `dig +short AAAA your-domain.com` must return the address of the server hosting the site. A forgotten AAAA record pointing to an old server is a classic cause: the authority tries IPv6 first and lands on the wrong machine. Also check `dig +short NS your-domain.com` to confirm that the name servers are the ones where you edit the zone.",{"title":53,"body":54},"Test the challenge path over HTTP","Place a test file in the `.well-known\u002Facme-challenge\u002F` folder of the web root, then run `curl -I http:\u002F\u002Fyour-domain.com\u002F.well-known\u002Facme-challenge\u002Ftest.txt`. Expected: a 200 code. A 301 to HTTPS is acceptable, a 403 or a 404 is not. Add `-L` to follow the redirect chain and spot a loop or an unexpected destination.",{"title":56,"body":57},"Identify what really answers","Compare the response headers: the `server` or `via` field gives away a proxy, a CDN or a web application firewall in the path. If the response is an anti-bot verification page, the authority, which is not a browser, will never pass it. Also reread the `.htaccess` rules: a directive that denies access to files starting with a dot blocks `.well-known`.",{"title":59,"body":60},"Read the CAA records","`dig CAA your-domain.com +short` lists the authorized authorities. No answer means there is no restriction. An answer that does not name your authority, for example `0 issue \"other-authority.example\"`, forbids issuance. Also look at the parent domain: a CAA published on `your-domain.com` applies to all its subdomains that do not have their own.",{"title":62,"body":63},"Consult the issuing client's log","The log names the exact cause. On a VPS, `certbot certificates` gives the status and `\u002Fvar\u002Flog\u002Fletsencrypt\u002Fletsencrypt.log` details every attempt. On cPanel, the AutoSSL log on the SSL Certificates page shows the domain and the reason for the failure. Note the exact message: the table below ties it to its cause.",{"type":65,"title":66,"headers":67,"rows":71},"comparison","Symptom, likely cause, fix",[68,69,70],"Observed symptom","Likely cause","Fix",[72,76,80,84,88,92,96],[73,74,75],"Domain not resolved (NXDOMAIN)","DNS zone deleted, name servers changed or record missing","Restore the A record in the authoritative zone",[77,78,79],"Timeout during connect","Port 80 closed or AAAA address pointing to another server","Open port 80, fix or remove the AAAA record",[81,82,83],"404 response on the challenge","Different web root, rewrite rule diverting the path","Serve `.well-known\u002Facme-challenge\u002F` from the right root",[85,86,87],"403 response on the challenge","Web application firewall, hidden-file blocking, country filter","Exclude this path from the blocking rules",[89,90,91],"Too many redirects","Loop between HTTP, HTTPS, www and bare domain","Fix the redirect rule, test with `curl -IL`",[93,94,95],"CAA forbidding issuance","CAA record that does not name the authority in use","Add the authority to the CAA record or remove it",[97,98,99],"Verification page instead of the file","CDN proxy or anti-bot protection active on the path","Disable the challenge on `\u002F.well-known\u002Facme-challenge\u002F`",{"type":36,"title":101,"body":102},"When DNS points elsewhere","This is the most frequent cause, and the quietest. After a migration, a change of host or a zone cleanup, the domain keeps displaying thanks to the cache or a correct A record, while an AAAA record still points to the old server. The authority prefers IPv6 when it exists: it queries the old machine, which no longer knows the challenge file, and validation fails even though everything looks fine from your computer.\n\nThe check is simple: compare `dig +short A your-domain.com` and `dig +short AAAA your-domain.com` with the real address of the server. If you do not use IPv6, delete the AAAA record rather than leaving it pointing elsewhere. Also check that the domain uses the name servers where you just fixed the zone; the procedure for editing a record is detailed in the guide \u003Ca href=\"\u002Fblog\u002Fajouter-enregistrement-dns-domaine\">on adding or modifying a DNS record\u003C\u002Fa>. Then wait for the caching delay announced by the old value to elapse before retrying.",{"type":36,"title":104,"body":105},"When a redirect or a firewall intercepts the challenge","The challenge is an ordinary HTTP request that the authority sends from its own servers. Anything that answers in its place, or answers something other than the expected file, makes validation fail. Three setups regularly cause the problem.\n\nThe first is the redirect that changes domain: a rule sending all traffic from `your-domain.com` to another address, including the challenge path, sends the authority looking for the file on a site that does not have it. The second is the security rule that refuses files whose name starts with a dot: it protects `.env` or `.git`, but it also blocks `.well-known`. The third is the web application firewall or the country filter, which treats the authority as an unknown visitor and answers 403.\n\nThe fix is not to disable protection, but to exclude precisely the `\u002F.well-known\u002Facme-challenge\u002F` path from redirect and blocking rules. A redirect from HTTP to HTTPS remains acceptable, as long as it keeps the requested path and ends on the same domain.",{"type":36,"title":107,"body":108},"When a CAA record excludes the authority","A CAA record is an allow list published in DNS: it lists the authorities allowed to issue for the domain. It is a good security tool, but it goes stale silently. Someone publishes `0 issue \"an-authority.example\"` during an audit, then the hosting moves to another authority, or AutoSSL changes provider, and issuance is refused with a message that mentions CAA.\n\nTo fix it, read the result of `dig CAA your-domain.com +short`, identify the authority your service uses (on cPanel, the Issuer column of the SSL Certificates page), then add an `issue` line with its name. If you do not need this restriction, delete the record. Remember that a CAA is read by walking up the tree: the main domain's record applies to subdomains. And for a certificate covering a wildcard subdomain, a separate `issuewild` line may be needed.",{"type":36,"title":110,"body":111},"When a CDN proxy sits in the middle","Putting a domain behind a CDN in proxy mode changes what the authority sees. It no longer talks to your server but to the CDN's, which may answer in your place with an edge certificate, a verification page or its own security rule. Depending on the mode chosen, renewal of the origin certificate works or does not.\n\nTwo settings matter. First, the encryption mode between the CDN and the origin: in flexible mode, the CDN talks to the origin in clear text, which causes a redirect loop if your server forces HTTPS; in strict mode, it requires a valid origin certificate, so an expiry becomes visible at once as an origin error. Second, the protections active on the challenge path: they must be lifted for `\u002F.well-known\u002Facme-challenge\u002F`, or you can switch to validation by DNS record, which does not depend on web traffic. During diagnosis you can also temporarily disable the proxy on the single record concerned, retry issuance, then re-enable it.",{"type":113,"title":114,"items":115},"ul","The error messages you run into, and their cause",[116,117,118,119,120,121],"**`DNS problem: NXDOMAIN looking up A`** — the name does not resolve: missing zone, modified name servers, typo in the requested domain.","**`Timeout during connect (likely firewall problem)`** — the authority cannot reach port 80: firewall, provider security group, or an AAAA record to a machine that is not listening.","**`Invalid response ... 404`** — the server answers but cannot find the file: wrong web root, a rewrite diverting the path, or the site served by another virtual host.","**`Invalid response ... 403`** — an active block: web application firewall, a rule denying hidden files, country filtering or anti-bot protection.","**`CAA record for your-domain.com prevents issuance`** — a CAA record does not name the authority in use; add it or remove the restriction.","**Domain control validation failure in AutoSSL** — the log reports that the domain does not point to this server or that the validation request was diverted; go back over steps 2 to 4.",{"type":43,"title":123,"steps":124},"Where to retry, once the cause is fixed",[125,128,131,134],{"title":126,"body":127},"On cPanel web hosting","Open the Security page in cPanel, SSL Certificates tab, rerun the AutoSSL check for the domain, then reread the expiry column. The step-by-step procedure is described in the guide \u003Ca href=\"\u002Fblog\u002Fverifier-relancer-certificat-ssl-cpanel\">on checking and rerunning the SSL certificate in cPanel\u003C\u002Fa>.",{"title":129,"body":130},"On a VPS with certbot","Test first without issuing anything: `certbot renew --dry-run` replays validation in a test environment. If the test passes, `certbot renew` really issues, then reload the web server so it serves the new file. The full setup is described in \u003Ca href=\"\u002Fblog\u002Fcertificats-ssl-lets-encrypt-vps\">the guide to Let's Encrypt certificates on a VPS\u003C\u002Fa>.",{"title":132,"body":133},"With an automated ACME chain","If a tool manages issuance for you, fix the cause then trigger its renewal manually just once. To make this flow reliable over time, see \u003Ca href=\"\u002Fblog\u002Fcertificats-tls-courts-automatiser-acme\">ACME automation with short-lived certificates\u003C\u002Fa>.",{"title":135,"body":136},"Check the result","Rerun the `openssl s_client` command from the first step: the end date must have changed. Reload the site in a private browsing window, because the browser may keep the old certificate in memory.",{"type":138,"title":139,"body":140},"tip","Prevent rather than diagnose","Each time you change DNS, add a redirect, enable a firewall or move behind a CDN, immediately replay the challenge test with `curl -I`. Monitoring the expiry date, with an alert as the deadline approaches, turns a site in error into a simple ticket handled calmly. Note in the site's file which authority issues the certificate: it is the information most often missing the day a CAA blocks issuance.",{"type":36,"title":142,"body":143},"Fix the condition, not the symptom","A failing renewal almost always means that a validation condition has changed: the name no longer points to the right place, the challenge path is blocked or diverted, an authority is excluded, a proxy has slipped between it and the server. The reading order is constant: DNS resolution, access to port 80, response on the challenge path, CAA record, proxy mode. Once the cause is restored, a single retry is enough. ServOrbit.com web hosting includes free SSL renewed automatically; when validation fails, the cause can be read in the AutoSSL log and fixed with the commands above.","SSL that renews without supervision","ServOrbit.com web hosting plans include a free SSL certificate, issued and renewed automatically. If a validation fails, the AutoSSL log shows the cause and the diagnosis is documented step by step.","See web hosting","\u002Fhebergement-web",[149,169,184],{"id":150,"slug":151,"slugs":152,"title":156,"excerpt":157,"readTime":158,"views":18,"isPinned":19,"publishedAt":159,"updatedAt":160,"category":161,"categories":166,"featuredImage":30,"bgImage":31,"posterImage":168,"relatedSolution":30},476,"check-renew-ssl-certificate-cpanel",{"fr":153,"en":151,"ar":154,"es":155},"verifier-relancer-certificat-ssl-cpanel","التحقق-من-شهادة-ssl-وإعادة-إصدارها-في-cpanel","verificar-renovar-certificado-ssl-cpanel","Check and renew the SSL certificate for your site in cPanel","View the status of your Let's Encrypt SSL certificate in cPanel and run AutoSSL with one click if your domain is not secure or the certificate has expired.",3,"2026-10-20T00:00:00+00:00","2026-10-20T17:28:17+00:00",{"id":162,"name":163,"slug":164,"color":165,"icon":164},12,"Guides","guides","bg-emerald-500\u002F10 text-emerald-400",[167],{"id":162,"name":163,"slug":164,"color":165,"icon":164},"\u002Fblog\u002Fcovers\u002Fverifier-relancer-certificat-ssl-cpanel-poster.svg",{"id":170,"slug":171,"slugs":172,"title":176,"excerpt":177,"readTime":23,"views":18,"isPinned":19,"publishedAt":178,"updatedAt":179,"category":180,"categories":181,"featuredImage":30,"bgImage":31,"posterImage":183,"relatedSolution":30},116,"free-ssl-certificates-with-lets-encrypt-on-a-vps",{"fr":173,"en":171,"ar":174,"es":175},"certificats-ssl-lets-encrypt-vps","شهادات-ssl-مجانية-باستخدام-lets-encrypt-على-خادم-vps","certificados-ssl-gratis-con-lets-encrypt-en-un-vps","Free SSL Certificates with Let's Encrypt on a VPS","Complete Let's Encrypt guide for VPS: certbot nginx, DNS-01 wildcard, systemd renewal, TLS hardening, rate-limit troubleshooting and certbot vs acme.sh vs Caddy.","2026-02-24T00:00:00+00:00","2026-09-30T11:20:34+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[182],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fcertificats-ssl-lets-encrypt-vps-poster.svg",{"id":185,"slug":186,"slugs":187,"title":191,"excerpt":192,"readTime":162,"views":193,"isPinned":19,"publishedAt":194,"updatedAt":195,"category":196,"categories":197,"featuredImage":30,"bgImage":31,"posterImage":199,"relatedSolution":30},204,"short-tls-certificates-automate-with-acme",{"fr":188,"en":186,"ar":189,"es":190},"certificats-tls-courts-automatiser-acme","شهادات-tls-القصيرة-أتمتة-التجديد-بـ-acme","certificados-tls-cortos-automatizar-con-acme","Short TLS certificates: automate with ACME","Let's Encrypt moves to 64-day certificates on February 10, 2027, then 45 days. Timeline, ARI and a checklist for certbot, acme.sh, Caddy, Traefik, nginx.",1,"2026-08-01T00:00:00+00:00","2026-10-23T13:27:09+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[198],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fcertificats-tls-courts-automatiser-acme-poster.svg",1793414299426]