Self-Hosted Site Shows SSL or Certificate Errors? How to Fix Them

Your home server was serving HTTPS happily for weeks, then one morning the browser throws up a full-page warning and refuses to load it. A certificate error on a self-hosted site is almost never the mystery it looks like. Nine times out of ten it is an expired Let's Encrypt certificate, a renewal that quietly failed, or a mismatch between the name on the certificate and the address you typed. Each one points to a clear, fast fix.

Quick Answer

Check the certificate's expiry date and your renewal logs first. Let's Encrypt certificates last 90 days and renew automatically, so a failed cron job or a stalled certbot timer leaves you serving an expired cert. The other common cause is a domain mismatch, where the certificate covers one name and you are visiting another. A manual sudo certbot renew plus a web-server reload resolves most cases.

Read the error before touching anything

The browser usually tells you exactly which problem you have. NET::ERR_CERT_EXPIRED means the certificate's 90-day window lapsed and renewal did not run. NET::ERR_CERT_COMMON_NAME_INVALID or a name-mismatch warning means the certificate's name does not match the URL, classically visiting the www version when only the bare domain was issued, or the reverse. A self-signed certificate warning means you are not using a trusted authority at all. Identify which one you are looking at and you have already narrowed the fix.

Fix one: expired or failed renewal

Certbot only renews when a certificate is within 30 days of expiry, and it relies on a cron job or systemd timer firing on schedule. A missed job, system downtime or a broken timer means the renewal silently never happened. Run a manual renewal to catch up:

sudo certbot renew

If renewal itself fails, the usual reason is the ACME challenge. Let's Encrypt verifies ownership by fetching a file at http://yourdomain/.well-known/acme-challenge/ and if that path is not reachable, validation fails. Confirm port 80 is open and your web server actually serves that directory before retrying.

Fix two: the server is serving the old certificate

A subtle trap is renewing successfully but seeing no change, because the certificate was renewed on disk while the web server still points at an old path or has not reloaded. Make sure your Nginx or Apache configuration references the live path, typically /etc/letsencrypt/live/yourdomain/fullchain.pem, then reload the service so it picks up the new file:

sudo systemctl reload nginx

Verify what is actually being served with an openssl s_client check against your domain rather than trusting that the renewal alone fixed it. Reverse proxies such as Traefik handle this differently, but the same principle holds: the new certificate is useless until the service serving it is restarted or reloaded.

Fix three: the domain mismatch

If the certificate is valid but the browser still complains, compare the name on the certificate against the URL you are visiting. A certificate issued for the bare domain will warn on the www subdomain, and vice versa. Reissue covering both names, for example with -d yourdomain and -d www.yourdomain, and point your configuration at the certificate that covers every hostname you actually use.

A reliable always-on box is the foundation that keeps these renewals running on schedule, and the mini PC range at Evetech covers low-power machines well suited to a home server that quietly handles its own certificate cron jobs. For heavier self-hosting, the best-selling desktops at Evetech offer the headroom to run multiple services behind one reverse proxy.

Frequently Asked Questions

How long do Let's Encrypt certificates last?

Ninety days. They are designed to renew automatically well before that, but if the renewal job does not run, the certificate simply expires and the browser blocks the site until you renew manually.

Why did my certificate stop renewing on its own?

Usually a missed cron job, a stopped systemd timer, system downtime during the renewal window, or a failed ACME challenge because port 80 or the challenge path was unreachable. Check the renewal logs for the exact cause.

I renewed but the browser still shows the old error. Why?

The web server is probably still serving the old certificate. Confirm your config points to the live certificate path and reload Nginx or Apache so it loads the renewed file.

What causes a name-mismatch error?

The certificate covers a different hostname than the one you are visiting, most often a www versus non-www split. Reissue the certificate to cover every name you use and update the server configuration to match.