Your Certificate Expired and Nobody Noticed

We audited a server recently and found two certificates that had been expired for over a month. Automatic renewal was enabled. The renewal timer was active. Nothing had alerted anyone.

This is more common than it sounds, and the reason is worth understanding — because it applies to almost every certificate you are running right now.

How automatic renewal actually works

When certbot is installed it registers a timer that runs twice a day. Each run checks every certificate it manages and renews anything within thirty days of expiry. It is genuinely reliable.

The catch is what happens when a renewal fails. Certbot tries, the attempt does not succeed, it logs the failure and exits quietly. Twelve hours later it tries again, fails again, logs again. It will do that for thirty days without ever reaching a human.

Why renewals fail

Almost never because certbot is broken. The usual causes are boring:

• DNS moved. The domain now points somewhere else, so the validation challenge never reaches the server holding the certificate.
• The vhost changed. A config edit months earlier stopped the server answering on the path the challenge uses.
• The domain lapsed. Nobody renewed the registration, so validation cannot complete.
• Duplicate certificates. Someone re-issued at some point, creating a second lineage. One renews, the other does not, and the web server is pointed at the wrong one.

Every one of these is a five-minute fix, if you know about it.

The real problem is not renewal — it is reporting

Most tooling shows you what it recorded when the certificate was issued. That number is right on day one and drifts from reality every day after. A dashboard saying "SSL: active" is telling you about the past.

The only figure worth trusting is the one read back off the server. Ask the machine what expiry date it is actually serving, compare that against today, and alert on the gap. That is a different question from "did we install a certificate", and it is the one that catches a failing renewal in week one instead of week five.

What to check on your own servers

• Run certbot certificates and read the real expiry dates rather than trusting a dashboard.
• Confirm the renewal timer is actually active — installed is not the same as running.
• Look for duplicate lineages with a numeric suffix. Two certificates for one domain means one of them is being ignored.
• Run a renewal dry run. It uses the staging endpoint, so it proves the process works without waiting sixty days to find out.

An expired certificate is not a hard problem. Not knowing about it for a month is.