SSL Certificate Not Expired but not working

[keithck73]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: https://www.elmtreefunding.com/

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is: MediaTemple

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Plesk

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

My certificate isn't wokring if you visit https://www.elmtreefunding.com/ but upon inspection, it doesn't expire until June 19, 2023

I did get an email from Let's Encrypt saying I need to renew because it expires on April 20.

So something is not right and the setup within Plesk looks correct.

Any thoughts?

[Bruce5051]

Hello @keithck73, welcome to the Let's Encrypt community.

The certificate being served by the server only has these in the SANs; www.elmtreefunding.com is missing.

DNS:elmtreefunding.com
DNS:webmail.elmtreefunding.com

You can see that here

• https://decoder.link/sslchecker/elmtreefunding.com/443
• https://decoder.link/sslchecker/www.elmtreefunding.com/443

[rg305]

For the visually driven:

You can see that the last cert to cover the "www" name will expire on April 20th.
As @Bruce5051 pointed out, the cert currently being served doesn't cover the "www" name.

Furthermore, cPanel doesn't even try to serve the name with the expected cert.
It uses the default cPanel cert for that name.
Which tells me that cPanel does no longer think it should be serving that name and in March 21st renewed to a cert with less names to keep in line with the names it think it should be serving.

So... the error comes from a misconfigured cPanel.
Add the "www" name back into it and have it renew the cert again.

[keithck73]

Thanks for the feedback. Media Temple's transition to GoDaddy has not been great. I reissued the certificate and looks like it's back up and running. Thanks again.