How renewals work and what to do when one fails

A Let's Encrypt certificate lasts 90 days, so a healthy site renews about every two months and nobody has to think about it. This article is for the day something does not go through: it explains the schedule SrvYard follows, which alerts you receive, what each warning on the certificate card means, and what to check first.

Read it once while everything works. The most useful thing you can do about renewals is to know where the warnings will show up before you need them.

Before you begin#

• A site with a certificate. See Get a free Let's Encrypt certificate if you do not have one yet.
• Permission to manage the site's SSL to press Renew now or Retry now. Anyone who can view the site can read the card.
• Custom certificates are different. They are never renewed by SrvYard. See Install a custom certificate for how to replace one by hand.

1. The schedule SrvYard follows#

Three jobs run every day on SrvYard's side. You do not configure them, but their timing explains what you see.

• Renewal, every day at 03:30 (UTC). SrvYard looks for Let's Encrypt certificates that are in use, issued by SrvYard and have automatic renewal on, and that have 30 days or less left. For each one it asks Let's Encrypt for a new certificate with the same names and method (HTTP on port 80, or DNS through your Cloudflare connection). Servers that are not ready are skipped and picked up the next day.
• Expiry alerts, every day at 08:00 (UTC). SrvYard emails the owners and admins about a certificate that has 14 days or less left, that has expired, or that is inside its renewal window but has a recorded error. The same certificate is not reported more than once every 24 hours.
• Retries, every minute. A certificate request that failed is retried when its next attempt is due (see step 4).

Because the renewal window opens 30 days before expiry, a first attempt that fails still leaves about a month of daily retries before the alerts start at 14 days. A problem that appears on a Monday is usually fixed long before a visitor sees a warning.

2. Read the certificate card#

Open the site and choose SSL.

1. Renew now. Renews the certificate immediately instead of waiting for the next daily run. It is offered for Let's Encrypt certificates that SrvYard issued. Use it after you fixed something that blocked a renewal.
2. The details. Expires shows the date and the days left. Validation says whether names are proven over HTTP (port 80) or DNS. Renewal says Automatic and when the last renewal happened (renewed 13 days ago). Manual means SrvYard will not renew it.

A healthy Let's Encrypt certificate shows Renewal: Automatic and, within a day of entering the 30 day window, a new Issued date. If Expires is under 30 days and the date does not move, something is wrong. Look for the red message in the next step.

3. When a renewal fails#

If SrvYard tries to renew the certificate in use and fails, nothing is taken away from your visitors: the old certificate keeps being served. The card tells you what happened.

1. The red message. The last renewal or change failed followed by the reason. Here the reason is Renewal skipped: automatic renewal is switched off for this certificate. The text continues: The certificate in use was not touched, and the renewal is retried daily. For a real error (a DNS record that moved, a closed port) the line shows the message from the failed attempt instead.
2. The details. The Expires date turns red when the end is close (in 6 days), and Renewal shows Manual. Both together mean nobody is going to renew it unless you do.

Work through the causes in this order:

• Automatic renewal is off. Press Renew now, then check that Renewal reads Automatic afterwards. If it stays manual, request a new certificate with Get a free certificate.
• A name no longer points at the server. The check names the host and the records it found, for example does not point at 203.0.113.10 (AAAA: none). Fix the DNS record, then press Renew now.
• Port 80 is closed or redirected. HTTP validation needs port 80 even when Force HTTPS is on. Allow it in the server's firewall and at your cloud provider.
• The Cloudflare connection is gone or its token changed. DNS certificates cannot be renewed without it. Connect Cloudflare again (see Wildcard certificates with DNS validation) and request a new certificate.
• A rate limit. Let's Encrypt allows only so many certificates per week for one registered domain, and the free srvy.sh zone hits that faster. Wait and try again.

4. When a new certificate request fails#

The above is about renewing a certificate that already works. A new request that fails (for example the first certificate of a site) follows its own rules.

1. Failed after 3 attempts. SrvYard tries a request three times, 30 minutes apart. The status shows where it stands (Attempt 2 of 3 failed, retrying at 14:30). After the third failure the certificate is marked Failed, the owners and admins are told once, and the card says No certificate in use if the site had none. Hover the status to read the last error.
2. Retry now. Runs the request again with the same settings. Press it after you fixed the cause. Cancel retries stops a scheduled attempt.

Some errors are never retried, because waiting cannot fix them: a refused contact email, a name that Let's Encrypt will not issue for (a policy or CAA record), a wildcard requested without DNS validation, an invalid request, or a domain that is not yours. For those the message says what to change. Others are retried because they often clear up on their own: a Let's Encrypt rate limit, DNS that has not propagated yet, port 80 not reachable, or a temporary server error on their side.

5. Choose who hears about it#

The expiry and failure emails go to the owners and admins automatically. To also reach a team channel, add a notification channel.

1. Add channel creates a Slack, Discord, Telegram or email channel.
2. The list. Each channel shows how many events it receives (for example 5 events), its filters and the result of its last message. Press Test on a channel to send a test message.

1. Certificate expiring. Sent by the 08:00 check described in step 1.
2. Certificate failed. Sent when a request has failed for good. Certificate issued and Certificate renewed (in the same group) tell you about the happy path.

Switch All events off to pick events one by one, and use Severity and Limit to to keep a channel quiet.

Troubleshooting#

• The certificate expired and the site shows a browser error. Get a new certificate right away: Get a free certificate (HTTP validation is fastest). If Force HTTPS is on, visitors cannot click past the error, so consider turning Force HTTPS off until the new certificate is in use. See Force HTTPS and HSTS.
• I pressed Renew now and nothing changed. Open the certificate's log (View output). The last line says which step failed.
• I received an expiry email but the card looks fine. The email was sent for another certificate of the same site, or for one that is not in use. Open Other certificates on the SSL tab.
• No alert arrived. Alerts go to owners and admins, and to channels that listen to Certificate expiring. Check the channel list in Settings > Notifications, and your spam folder.
• Another certificate is still being set up. Only one certificate operation can run per site at a time. Wait for it to finish, then retry.

Related#

• Get a free Let's Encrypt certificate: how a certificate is issued in the first place.
• Wildcard certificates with DNS validation: the token that DNS renewals depend on.
• Install a custom certificate: the manual route.
• Force HTTPS and HSTS: why an expired certificate is such a hard failure.