Received Expiration Email But Already Renewed Certificate: What to Know and Do

If you have received an expiration email for a certificate that you believe has already been renewed, you are in the right place. :slightly_smiling_face:

What to Know

Let's Encrypt...

  • sends an expiration email twenty days before a certificate expires, and another one ten days before it expires
  • will not send an expiration email for a renewed certificate
  • considers a certificate to be renewed if a newer duplicate of that certificate has been issued
  • considers a certificate to be a duplicate of another certificate if both certificates have the exact same list of subject alternative names (SANs), regardless of order

If you were issued a new certificate that...

  • does include one or more (sub)domain names that your previous certificate did not include
  • does not include one or more (sub)domain names that your previous certificate did include

then your new certificate is not considered a renewal of your previous certificate because your new certificate is not a duplicate of your previous certificate.

What to Do

Begin by determining which certificate is actually being served. While there are numerous ways to accomplish this, the simplest way is just to visit the website associated with the certificate in question then click on the padlock next to the address to view the certificate information. If the certificate shown expires in more than twenty days, the expiration email that you received was for a different certificate than the one being served.

For more information, you can use the Qualys SSL Labs Server Test to view detailed information about the entire certificate chain being served. Additionally, you can find detailed information about every Let's Encrypt certificate ever issued to you by searching with crt.sh.

15 Likes
Let's Encrypt R3 Certificate Expiration Notice
SSL Certificate Renewal
Let's Encrypt certificate expiration notice
Cert Renewal Confusion
Certification expiration notice for what I thought was an overwritten certificate
Glossary for letsencrypt.org/docs
I received a message from letsencrypt on: aug 30 2022 with Your certificate (or certificates) for the names listed below will expire in 9 days (on 09 Sep 22 12:48 +0000). Please make sure to renew your certificate before then, or visitors to your web site
Email received query
Valid certificate but expiry notification from Let's Encrypt
Should I consider Let's Encrypt's email?
Expiration notices arrives months too early
How can we fix this?
Certificate renewal email doesn't match certificates?
Received email about certificate expiration
Why am I getting expiration notification for deleted certificates?
Renewals visible on Let's Debug.net
My certificate will expire in 1 day
Why am I getting expiration notices?
Let's Encrypt certificate expiration emails
Received expiration notice for domain but certs renewed
Let's Encrypt certificate expiration notice for domain ".......com" (and 1 more)
Let's Encrypt certificate expiration emails
Let's Encrypt renewal for the domain leankanban.com
False alarm of certificates expiration
Got certificate expiry emails near term that's not due for renewal
Different expiration date for SSL certificate
Got an Email from letsencrypt to Renewal the certificates
[SOLVED] Reminder domain renewal out of sync
Expire Bot says 17 days, cert shows 81!
Email regarding a certificate about to expire
Login to Manage Automatic Updates
Ssl renewal offset
I got certificate expiration notice even though domain not about to expiry
Caution: certbot certonly doesn't use renewal configuration information
Expiration notice email... but it's not close to expiration!
Let's Encrypt certificate expiration - reporting incorrect expired date ranges
Information about alert for certificate
Staging certificate messages?

Clear, concise, and understandable by people of all tech expertise. Well done!

3 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.