Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
The domain name was purchased over 10 years ago via GoDaddy but it points to our website which is hosted by Content Management System (CMS) provider - Metropublisher.
Our website (trumpetmediagroup.com) started malfunctioning two days ago indicating that the Security Certificate expired on 10 April 2023.
In the over 10 years of being with our CMS Provider or GoDaddy, I have not been involved in the renewing of the Certificate. We simply had to turn on HTTPS in the CMS and everything has run smoothly for almost 7 years.
I have not had any headway with Metropublisher - as they simply told me to switch on HTTPS within the CMS (which was never off anyway).
It is clear that the Certificate needs to be renewed since it has expired - but Metropublisher are passing the buck back to me.
Are you looking to switch to using Let's Encrypt as your Certificate Authority?
ACME is intended to provide automictic Certificate renewals every 60 days with the Certificates having a 90 day life span.
There are other Free ACME Certificate Authorities as well
Do you have administrative access to the actual web server? Or can you only manage it through a "control panel" type application? Since if you usually just "turn on HTTPS" in your control panel (which is how this kind of thing ideally works), and that isn't working, and you can't access the server itself (like, lo in, change config files, runs applications, etc.), then you need whomever does have that access (who is probably whatever company set up that control panel) to fix the problem. There really isn't anything you can do to fix it.
Surely that would be because the last (expired) cert is from Let's Encrypt. But since that one's been issued, someone's made a real dog's breakfast of the CAA records:
A whole mess of Amazon-related entities, along with "someca.com" for good measure, but indeed Let's Encrypt is prohibited. @FemiO, you need to fix your DNS records. If Metropublisher handles those, they need to fix them. But they're the reason you can't renew your cert.
Other than the CAA records, you recently got a cert from Amazon. This was shortly after your most recently issued cert by Let's Encrypt. (cert history here)
That, along with the CAA records, looks like someone tried to change your architecture to be on AWS. For example, by adding CloudFront or an ELB.
Your DNS just points to an AWS EC2 instance (not CF or an ELB) so maybe someone tried something and backed it off but leaving the faulty CAA records behind?
Financial.
[that is the one that counts the most!]
I dare say you have control of your wallet and that is all you need.
Simple tell whomever is charging you for said service [likely included in the hosting plan]...
Starting with the DNS administrators:
Thank you so much all - for the prompt help and advice.
I deleted all the CAA records which I had added in January when a Shop was being added to our Website. It was a requirement of the 3rd-Party shop provider to make those amendments.
Following the deletion of the CAA records, the Certificate has now been automatically renewed this morning and our Website now working properly.
