Linux SSL/TLS Certificate Errors — Let's Encrypt, Chain, and Renewal Troubleshooting

Fix Linux SSL certificate errors including Let's Encrypt renewal failures, certificate chain issues, expired certificates, and certbot troubleshooting. This guide covers everything you need to know about this topic, including common causes, step-by-step solutions, and answers to frequently asked questions.

Here are the key things to understand: Let's Encrypt provides free SSL certificates via certbot — auto-renewal is critical. Certificate chain must include: server cert + intermediate cert(s) — root cert is pre-installed in browsers. Certbot renewal runs via cron or systemd timer — check with certbot renew --dry-run. Certificates expire after 90 days (Let's Encrypt) — missed renewals cause site downtime. Certificate errors can prevent email delivery (Postfix TLS), API calls (curl), and web browsing. Understanding these fundamentals will help you diagnose and resolve this issue more effectively.

The most common reasons this occurs include: Let's Encrypt certbot renewal failed silently — no notification configured. Certificate chain incomplete — intermediate certificate missing from server config. Port 80 blocked by firewall preventing HTTP-01 ACME challenge validation. certbot installed via OS package (outdated) instead of snap (current). Web server config pointing to old certificate path after certbot renewal. Identifying the root cause is the first step toward finding the right solution.

To resolve this, follow these recommended steps: Check certificate expiry: openssl s_client -connect domain.com:443 2>/dev/null | openssl x509 -noout -dates. Test renewal: certbot renew --dry-run to verify renewal will succeed. Fix HTTP-01 challenge: ensure port 80 is open and the web server serves /.well-known/acme-challenge/. Install certbot via snap (recommended): sudo snap install --classic certbot. Check full certificate chain: openssl s_client -connect domain.com:443 -showcerts. Force renewal: certbot renew --force-renewal (use sparingly — Let's Encrypt has rate limits). If these steps do not resolve the issue, consider consulting additional resources or a qualified professional.

This article is part of our Linux Error Codes collection on Error Codes Wiki. We provide comprehensive, up-to-date information to help you find solutions quickly.