Replace the expired intermediate certificate on Apache
Why it matters
One of the intermediate certificates the server sends has expired, so clients that build the chain from what the server sends reject the connection. It usually comes from an old certificate bundle file that was never refreshed.
The fix
- Point SSLCertificateFile at the current fullchain.pem. If you still use SSLCertificateChainFile, replace that file with the CA's current bundle or remove the directive.
- Test the configuration and reload Apache.
/
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
The examples use example.com. Replace it with your own domain.
Related
- Reported by the certificate chain and expiry check
- Renew the expired TLS certificate
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Replace the self-signed certificate with a trusted one
- Use a certificate from a publicly trusted authority
- Serve the full certificate chain
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.