Why Let's Encrypt auto-renewal fails (and how to catch it)
Let's Encrypt certificates last 90 days and renew automatically, until they don't. Renewal is usually attempted about 30 days before expiry, so a certificate with only a week or two left almost always means renewal has been failing for weeks.
The usual causes
- DNS moved. The domain now points at a new server or a CDN, so the old server can no longer complete the HTTP-01 challenge.
- Port 80 is blocked or redirected. A firewall rule, security plugin or redirect sends
/.well-known/acme-challenge/somewhere it can't be read. - The site moved hosts. The old host keeps trying to renew a certificate it can't validate, and the new host never issued one. Visitors get a name-mismatch error showing the host's default certificate.
- A CAA record on the domain doesn't list
letsencrypt.org. - Rate limits after many failed attempts or duplicate certificates.
- The renewal job isn't running. On self-managed servers, the certbot timer or cron job was removed, or the web server is never reloaded to pick up the new certificate.
How to diagnose
sudo certbot renew --dry-run sudo journalctl -u certbot --since "-7 days"
On managed hosting (cPanel AutoSSL, SiteGround, Kinsta, WP Engine and others) the SSL page in the control panel shows the last error. It's usually a DNS or CDN problem.
Catch it early
Let's Encrypt stopped sending expiry reminder emails in 2025, so nothing warns you anymore unless you set it up. Lapse connects to each site like a browser does, reads the certificate actually served, and alerts you at 14, 7, 3 and 1 days, which is only when auto-renewal has clearly failed.