When a website's SSL certificate expires, visitors will see an unsecured warning in their browser. This not only reduces user trust; WHMCS also creates serious problems for payment systems, API connections, game panels and customer logins.

Let's Encrypt certificates are free but must be renewed periodically. If Certbot is not configured correctly, the renewal will fail and the SSL may expire.

1. Checking Available Certificates

First check what certificates are present on the server:

certbot certificates

This command shows the certificate name, domains, file paths and expiration date.

If there is no certbot command it may not be installed:

certbot --version

2. Performing Refresh Testing

To test the certificate before actually renewing it:

certbot renew --dry-run

This command tests the refresh process. If there is an error, it allows you to see the problem before the actual renewal day.

3. Most Common Certbot Errors

Most Let's Encrypt renewal errors are related to domain validation and web server access.

• Invalid response: Let's Encrypt cannot access the verification file.
• Connection refused: Port 80 or 443 may be closed.
• Timeout during connect: The domain may not be directed to the server or the firewall may be blocking it.
• Unauthorized: The domain verification file may be returning incorrect content.
• Too many certificates: Certificate attempts may have been made too frequently.

4. Checking Domain IP Routing

For certificate renewal to work, the domain must be directed to the correct server IP address.

dig domainadi.com +short

If dig is not installed:

apt install dnsutils -y

On CentOS-based systems:

yum install bind-utils -y

The IP returned by the domain must be the same as the IP address of the server on which SSL will be installed.

5. Checking Ports 80 and 443

Let's Encrypt often wants to access port 80 for HTTP authentication. If port 80 is closed, authentication may fail.

ss -tulpn | grep -E ':80|:443'

If you are using a firewall, make sure ports 80 and 443 are open.

For UFW:

ufw allow 80/tcp
ufw allow 443/tcp
ufw reload

For Firewalld:

firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

6. Nginx or Apache Config Testing

If there is an error in the web server config file, the web service may not be reloaded after the certbot refresh.

For Nginx:

nginx -t

For Apache:

apachectl configtest

If there are no errors, you can reinstall the services:

systemctl reload nginx

or:

systemctl reload apache2

7. Manual Renewal of SSL Certificate

If all checks are correct, you can run the refresh manually:

certbot renew

Nginx example if you only need to recertify for a specific domain:

certbot --nginx -d domainadi.com -d www.domainadi.com

Apache example:

certbot --apache -d domainadi.com -d www.domainadi.com

8. Checking the Auto Refresh Scheduler

Certbot usually auto-refreshes with systemd timer or cron.

systemctl list-timers | grep certbot

To check timer status:

systemctl status certbot.timer

If the timer is off:

systemctl enable certbot.timer
systemctl start certbot.timer

Common Mistakes

• Trying to get SSL when domain IP address is wrong
• Close port 80 and wait for HTTP authentication to work
• Not checking authentication structure when Cloudflare proxy is on
• Mistaking Nginx/Apache config error for certbot error
• Not testing auto-renewal until SSL expires

FAQ

If the SSL has expired, will the site shut down completely?
The site may technically work, but the browser shows a security warning. This seriously reduces customer trust.

Why does Certbot renew fail?
Usually the domain is directed to the wrong IP, the 80/443 port is closed, the web server config is incorrect, or the verification file is not accessible.

Is SSL renewal a problem when using Cloudflare?
Incorrect SSL mode or proxy configuration may affect the verification process. Domain verification method should be chosen accordingly.

Safety and Operations Recommendations

• Check SSL expiration dates regularly.
• Run the certbot renew --dry-run test periodically.
• Do not close ports 80 and 443 unnecessarily.
• After web server config changes, run nginx -t or apachectl configtest.
• Do not neglect SSL monitoring on domains that use payment and customer panels.

This article is specially prepared for PvPServer.