SSL Auto-Renewal Checklist for Nginx Certbot
SSL expiration can make a website look broken or unsafe. If you use Nginx and Certbot, you should not only install SSL once. You need to confirm that renewal works, Nginx reloads correctly and DNS still points to the right server.
Common causes of SSL renewal failure
- Domain no longer points to the server.
- Port 80 is blocked.
- Nginx config is broken.
- Certbot renewal hook fails.
- Cloudflare or firewall blocks validation.
- Old certificates remain in config.
Checklist
- Check current certificate expiration date.
- Confirm domain points to the correct VPS IP.
- Confirm port 80 is open for validation.
- Run certbot renew dry run.
- Check Nginx config syntax.
- Confirm Nginx can reload after renewal.
- Check Certbot timer status.
- Review Certbot renewal logs.
- Remove broken duplicate SSL configs if needed.
- Set a reminder before certificate expiration.
Final check
Your SSL setup is healthy only when dry-run renewal succeeds and Nginx reloads without configuration errors.
Estimated Time
20–40 minutes
Use Case
Use this checklist after installing SSL or when you want to confirm Certbot auto-renewal works on an Nginx VPS.
Common Mistakes
- Blocking port 80.
- Ignoring failed dry-run.
- Editing SSL paths manually without backup.
- Leaving broken old server blocks.
- Assuming SSL renews without testing.
Related Commands
sudo certbot renew --dry-run
sudo nginx -t
sudo systemctl reload nginx
systemctl list-timers | grep certbot
sudo ufw status
curl -I https://example.com