Replace the expired intermediate certificate on nginx

Why it matters

One of the intermediate certificates the server sends has expired, so clients that build the chain from what the server sends reject the connection. It usually comes from an old certificate bundle file that was never refreshed.

The fix

1. Make sure ssl_certificate points at the current fullchain.pem and not at a manually assembled bundle that includes an old intermediate.
2. Test and reload nginx.

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject