Renew the expired TLS certificate on Caddy

Why it matters

Browsers refuse to open a site whose certificate has expired and show visitors a full-page security warning. API clients and mobile apps fail outright, so the site is effectively down for them.

The fix

1. Caddy obtains and renews certificates by itself, so an expired one means renewal is failing. Read the log (for a systemd install, journalctl -u caddy) for the ACME error.
2. Check that ports 80 and 443 reach Caddy from the internet, that the DNS records for the host point at this server, and that no CAA record excludes your CA.
3. Make sure the Caddy data directory is writable by the Caddy user. It stores the certificates and account keys.
4. After fixing the cause, run caddy reload or restart the service and Caddy will retry.

journalctl -u caddy --since "1 day ago" | grep -i -E "error|obtain|renew"
sudo systemctl reload caddy

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject