Certificate renewal fails quietly
Automatic renewal is great right up until the day it stops working, and you usually learn about that from a browser warning.
Most of my failures came from the same few causes:
- Port 80 was closed by a firewall change made months earlier.
- Standalone mode could not bind because the web server already held the port.
- The certificate renewed fine, but nothing reloaded the service using it.
Webroot validation removes the first two. The web server keeps running and only has to serve one extra directory. For the third, put the reload in the renewal hook and test it by forcing one renewal when you set things up.
A small script that reads the expiry date and complains under 20 days is still worth having, because it checks the result instead of the process.
openssl x509 -in fullchain.pem -noout -enddate