Renew the certificate before it expires on Caddy
Why it matters
A certificate that is close to its end date will cause a site outage if it is not renewed in time. Automatic renewal normally replaces certificates well before then, so this often means renewal has silently stopped working.
The fix
- Caddy renews certificates automatically when about a third of their lifetime remains. If one is close to expiry, renewal is failing. Read the Caddy log for the ACME error.
- Check that ports 80 and 443 reach Caddy, the DNS records point at this server and no CAA record excludes your CA.
bash
journalctl -u caddy --since "7 days ago" | grep -i -E "error|renew" Related
- Reported by the certificate chain and expiry check
- Renew the expired TLS certificate
- Fix a certificate that is not valid yet
- Install a certificate that covers this hostname
- Replace the self-signed certificate with a trusted one
- Use a certificate from a publicly trusted authority
- Serve the full certificate chain
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.