I am experiencing persistent SSL certificate issues on a restaurant menu website that is hosted on a VPS and served through a standard web stack (Nginx with a reverse proxy setup). The site previously worked fine over HTTPS, but recently browsers began showing security warnings indicating that the certificate is invalid or expired. I attempted to reissue the certificate using Let’s Encrypt, but the process fails intermittently depending on the validation method used. Sometimes the certificate appears to be issued successfully, yet the browser still reports errors such as “certificate not trusted” or “common name invalid.” This inconsistency makes it difficult to determine whether the problem lies with the certificate itself, server configuration, or DNS resolution.
One of the main complications seems to be related to domain and subdomain handling. The website uses both the root domain and a www subdomain, and traffic is redirected between them depending on the request. During the ACME challenge process, HTTP-01 validation occasionally fails with errors suggesting that the challenge file cannot be fetched, even though the path appears accessible when tested manually. In other attempts, DNS-01 validation succeeds, but the issued certificate does not appear to cover all expected hostnames. I am unsure whether redirect rules, virtual host configuration, or incorrect challenge responses are causing these failures.
Another concern is the interaction between the SSL configuration and caching layers. The site is fronted by a CDN and also uses server-side caching for performance. After renewing or reissuing the certificate, some clients continue to receive the old certificate while others receive the new one, leading to mixed reports from users. Clearing caches and restarting services only partially resolves the issue. I am not sure whether the CDN is caching the previous certificate, whether the origin server is serving different certificates based on SNI, or whether there is a mismatch between the full chain and intermediate certificates being served.
The renewal process itself is also unreliable. Automated renewals are set up using a standard ACME client, but renewal attempts sometimes fail silently or produce warnings without clear errors. Logs occasionally mention rate limits, challenge failures, or authorization reuse issues, but the messages are not consistent across attempts. Since this website is updated frequently and expected to be accessible at all times, manual intervention for certificate renewal is not a sustainable solution. I would like to understand how to properly diagnose renewal failures and ensure that automated renewals work reliably without risking downtime.
Additionally, I am concerned about server configuration details such as certificate chain ordering, intermediate certificates, and TLS protocol settings. Online SSL testing tools sometimes report missing intermediates or incomplete chains, even though the certificate files appear correct on disk. I am using modern TLS settings and have disabled deprecated protocols, but I am unsure whether this could be contributing to compatibility issues with certain clients. Clear guidance on verifying correct chain installation and avoiding common configuration mistakes would be very helpful.
I am looking for advice on best practices for managing Let’s Encrypt certificates for a production website that serves dynamic content and uses redirects, caching, and possibly multiple domains. I want to ensure that the certificate setup is robust, future-proof, and easy to maintain as the site evolves. Any insights from the community on diagnosing validation failures, avoiding renewal issues, and ensuring consistent certificate delivery across all clients would be greatly appreciated. Sorry for long post
