Skip to content

How to fix certificate expiry and chain errors

Security1 min readFixes 2 checks cert-chain-valid, cert-expiry-days

An expired or incomplete certificate shows visitors a full-page warning. Automate renewal and send the full chain.

Step by step, with screenshots: A monthly site health routine, done in 30 minutes →

Check your own site

Runs these 2 checks and the other 185, free, in about 45 seconds.

What a passing site looks like

  • The TLS certificate chain validatesfail · −12 ptseffort M
  • Certificate expiry: passeswarning · −4 ptseffort S

1. The TLS certificate chain does not validate

Why it matters. Browsers cannot verify who issued the certificate, so visitors see "Your connection is not private" instead of your page. The usual causes are a missing intermediate certificate, an expired certificate or a name mismatch.

How to fix it.
  1. Install the full chain (your certificate plus the intermediate) that your certificate authority provides, not just the leaf.
  2. Check that the certificate covers exactly this hostname, with and without www.

2. Certificate expiry

Why it matters. When the certificate expires, every browser shows a full-page warning and most visitors leave. Automatic renewals fail silently more often than you would expect.

How to fix it.
  1. Renew the certificate now; with Let's Encrypt, run certbot renew and check the auto-renew job's logs.
  2. Add a monitor so you get an email 14 days before the next expiry.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.