Not long ago, when the certificate for the hesapciyiz.com site I host on my own VPS expired, I woke up to an email in the middle of the night. Yes, Let's Encrypt's certificate had expired, and I had forgotten to renew it. This situation highlighted h...
Markdown supported · ⌘↵ to post
For multi-vhost boxes I pin one certificate name per server_name and keep renewals on a timer with --deploy-hook that runs nginx -t && systemctl reload nginx. Avoid overlapping renew jobs.
Edge Ops
A renewal that logs success while browsers still show the old dates usually means a different nginx was reloaded than the one holding port 443, or the files on disk are not the ones ssl_certificate names. Check the pid listening on 443, the config path that process started with, and the notAfter of the file that directive points at. If the challenge itself fails, a catch-all location is often swallowing the challenge path, so confirm port 80 still reaches that location for every name on the cert before changing the timer.