The following certs could not be renewed SSL / TLS Origin: Network Last updated 4 Nov 2026

Certbot: Failed to renew certificate example.com with error — The following certs could not be renewed: /etc/letsencrypt/live/example.com/fullchain.pem (failure)

certbot renew failed for one or more certificates, so they will expire if you don't fix it.

Exact message you may see The following certs could not be renewedFailed to renew certificate with errorAttempting to renew cert (example.com) from /etc/letsencrypt/renewal/example.com.conf produced an unexpected errorAll renewals failed. The following certificates could not be renewedcertbot renew failed
Explore the map of this error Full error map →
Seen on: SSL Linux

Meaning

Read /var/log/letsencrypt/letsencrypt.log for the real error. Common causes: the web server no longer serves /.well-known/acme-challenge/, port 80 closed or redirected badly, DNS changed, plugin/authenticator mismatch in renewal/*.conf, or a stopped web server when using standalone. Test with certbot renew --dry-run.

Common causes

  • Port 80 blocked or HTTP→HTTPS redirect blocking the challenge
  • Webroot path changed
  • Standalone authenticator while Nginx uses port 80
  • DNS no longer pointing to the server
  • Hook script failing

⚡ Quick fix

  1. certbot renew --dry-run and read the log
  2. Fix the renewal config (/etc/letsencrypt/renewal/example.com.conf)
  3. Make sure a timer/cron runs certbot renew and reloads the web server

Detailed fix by platform

Linux

  1. sudo certbot renew --dry-run ; sudo systemctl list-timers | grep certbot ; sudo tail -50 /var/log/letsencrypt/letsencrypt.log

How to diagnose

  1. Log — Error in letsencrypt.log?
  2. Port 80 — Reachable?
  3. Timer — Active?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

Challenge failed for domain — Let’s Encrypt / Certbot: Challenge failed for domain example.com — Invalid response from http://example.com/.well-known/acme-challenge/x: 404 (SSL / TLS)Challenge failed for …Could not automatically find a matching server block — Certbot: Could not automatically find a matching server block for example.com. Set the `server_name` directive to use the Nginx installer (SSL / TLS)Could not automatical…DNS problem: NXDOMAIN looking up A — Certbot: Detail: DNS problem: NXDOMAIN looking up A for www.example.com - check that a DNS record exists for this domain (SSL / TLS)DNS problem: NXDOMAIN…DST Root CA X3 expired (old clients fail) — Old clients: certificate has expired — Let's Encrypt chain uses expired DST Root CA X3 (OpenSSL 1.0.x, Android < 7.1.1) (SSL / TLS)DST Root CA X3 expire…ERR_CERT_DATE_INVALID — NET::ERR_CERT_DATE_INVALID (certificate expired) (JavaScript)ERR_CERT_DATE_INVALIDInvalid response from .well-known/acme-challenge: 404 — Certbot: Detail: Invalid response from http://example.com/.well-known/acme-challenge/abc: 404 (SSL / TLS)Invalid response from…Problem binding to port 80: Could not bind to IPv4 or IPv6 — Certbot: Problem binding to port 80: Could not bind to IPv4 or IPv6 (standalone authenticator) (SSL / TLS)Problem binding to po…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during connec…The follo…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.