Let's Encrypt Renewal Failing? Find and Fix the Cause
Let's Encrypt certificates last 90 days and should renew on their own about 30 days before expiry. When renewal breaks, nothing warns you: Let's Encrypt stopped sending expiry emails in 2025. Here is how to find out why renewal fails and fix it.
Full guide: Full Let's Encrypt guide
1. Check the timer runs
The apt package uses certbot.timer; the snap uses snap.certbot.renew.timer.
systemctl list-timers | grep -i certbot2. Run a dry run
This shows the exact error without touching your certificates.
sudo certbot renew --dry-run3. Read the log
The newest attempt is at the end.
sudo tail -n 80 /var/log/letsencrypt/letsencrypt.log4. Match the error
Most renewals fail for one of these reasons.
| Error | Fix |
|---|---|
| Connection refused / timeout | Port 80 blocked by UFW or the cloud firewall; open it |
| Unauthorized / 404 on acme-challenge | A redirect or rewrite blocks /.well-known/acme-challenge/, or the webroot path changed |
| DNS problem: NXDOMAIN | The domain no longer points at this server; fix DNS or remove the name |
| Too many failed authorizations | Rate limit after repeated failures; fix the cause and wait an hour |
| Plugin not found | Certbot was reinstalled differently (apt vs snap); reinstall the plugin used in /etc/letsencrypt/renewal/*.conf |
5. Renew and reload
After fixing, renew for real and make sure the web server picked up the new certificate.
sudo certbot renew
sudo systemctl reload nginx # or apache26. Verify the new expiry date
sudo certbot certificates
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -enddateFAQ
Is Let's Encrypt free?
Yes. It is a free, nonprofit certificate authority trusted by all major browsers.
Does Let's Encrypt still email me before expiry?
No. It stopped expiry notification emails in 2025, so check certbot renew –dry-run or monitor the expiry date yourself.
Further reading: Let's Encrypt rate limits