Debian 9 – certbot renewal fails and TLS certificates expire – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

HTTPS endpoints begin serving expired certificates, breaking client trust.

Environment & Reproduction

Occurs when renewal timer runs but ACME challenge fails.

sudo certbot renew --dry-run
systemctl status certbot.timer
openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -dates

Root Cause Analysis

HTTP-01 challenge path blocked, DNS mismatch, or stale webserver hooks.

Quick Triage

Check renewal logs and challenge endpoint reachability.

sudo tail -n 120 /var/log/letsencrypt/letsencrypt.log
curl -I http://example.com/.well-known/acme-challenge/test
ss -lntp | grep -E ':80|:443'

Step-by-Step Diagnosis

Validate domain resolution and active certbot plugin configuration.

dig +short example.com
certbot certificates
ls -l /etc/letsencrypt/renewal

Solution – Primary Fix

Repair challenge route, rerun renewal, and reload web service.

sudo certbot renew --dry-run
sudo certbot renew
sudo systemctl reload nginx || sudo systemctl reload apache2

Solution – Alternative Approaches

Switch to DNS-01 validation when HTTP challenge is restricted.

sudo certbot certonly --manual --preferred-challenges dns -d example.com -d '*.example.com'

Verification & Acceptance Criteria

Certificate expiry date extends and browser trust is restored.

openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -enddate
systemctl status certbot.timer

Rollback Plan

Revert to prior certificate backup while fixing automation.

sudo cp -a /etc/letsencrypt /var/tmp/letsencrypt.bak.$(date +%s)

Prevention & Hardening

Monitor renewal outcomes and certificate expiry proactively.

systemctl list-timers | grep certbot
sudo certbot renew --dry-run

Related Errors & Cross-Refs

Often linked to DNS outages, reverse-proxy misroutes, or firewall blocks.

Related tutorial: View the step-by-step tutorial for Debian 9.

View all Debian 9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian Certbot and ACME best-practice documentation.