Apache SSL certificate expired

apache ssl certificate expired on a public site means mod_ssl still presents a leaf whose notAfter is in the past—renew, install PEMs your vhosts reference, then graceful reload and prove the fix with an external handshake.

Apache httpd remains the TLS terminator on countless Linux and Windows deployments, often behind a load balancer that also caches certificate material. Platform engineers, hosting support, and application teams usually notice apache ssl certificate expired first through browser warnings, API client failures, or synthetic monitors—not from a quiet line in a log file.

The common mistake is assuming fresh files under a Lets Encrypt live tree fixed production. mod_ssl reads paths from VirtualHost blocks at worker startup and reload; until httpd recycles workers, customers can see yesterday's serial even when disk mtimes moved forward overnight.

This guide walks through confirming expiry on the wire, renewing or importing a replacement, pointing SSLCertificateFile and SSLCertificateKeyFile at the right PEMs, running configtest and graceful reload, and validating SNI on the hostname users actually type. Pair it with Certbot renew failed troubleshooting when ACME automation is the root cause.

What to check

Separate three layers before you change anything: the certificate strangers receive on port 443, the PEM files your Apache vhost directives reference, and whether a CDN or load balancer terminates TLS in front of httpd.

For apache ssl certificate expired, the incident is confirmed only when an external openssl or browser handshake shows notAfter before the current UTC instant on the correct ServerName. Checking a PEM in /etc/ssl without SNI often reads a default vhost that nobody uses.

Compare serial number on disk with serial over the internet. A mismatch after a supposed renewal means graceful reload did not run, the wrong vhost answers SNI, or traffic never reaches this Apache instance. Review where Apache stores SSL certificates if paths split between Lets Encrypt, copied bundles, and Central Certificate Store layouts.

Domain registration expiry is a different failure mode. RDAP or registrar portals matter when validation cannot complete, but they do not replace fixing the expired leaf Apache serves.

Step-by-step

Confirm live expiry and SNI

HOST=www.example.com
echo | openssl s_client -connect "${HOST}:443" -servername "${HOST}" 2>/dev/null \
  | openssl x509 -noout -dates -serial -subject -issuer

Run the same command against the load balancer VIP if that is what DNS publishes, then against the origin if you have a bastion path. Note whether HTTP redirects to HTTPS on a different name than the cert covers.

Map the vhost that owns the hostname

apachectl -S 2>/dev/null | grep -i example
# Debian/Ubuntu:
apache2ctl -S 2>/dev/null | grep -i example

Record SSLCertificateFile and SSLCertificateKeyFile from the matching VirtualHost. If multiple httpd instances exist, repeat on each unit that binds customer IPs.

Inspect on-disk PEM validity

openssl x509 -in /etc/letsencrypt/live/HOST/fullchain.pem -noout -dates -serial

Replace the path with the value from your vhost, not a guess. When using a commercial bundle, verify intermediate files are concatenated into the file Apache serves as the certificate chain file if you use SSLCertificateChainFile or an all-in-one fullchain layout.

Renew or obtain a new certificate

For Lets Encrypt with certbot certonly or an automated timer, fix renew errors first using Certbot renew failed. After a successful issuance, symlinks under the live directory should update; avoid editing archive copies by hand.

For manual or commercial renewal, install the new leaf and chain PEMs to the paths your vhost already references, or update the vhost to match your standard layout and run apachectl configtest before reload.

Reload Apache gracefully

apachectl -t && apachectl graceful
# or: apache2ctl -t && apache2ctl graceful

Document hook timing if certbot deploy hooks should have done this automatically—see reload Apache after SSL renewal and the batch-2 companion reload Apache after cert renewal.

Re-verify from outside

Repeat the openssl s_client probe. Accept the change only when notAfter moved forward and serial changed versus the incident opening capture.

How to read the output

notBefore and notAfter are GMT timestamps on the served leaf. After notAfter, PKIX clients reject the certificate regardless of issuer reputation. serial should change when you install a genuinely new issuance, not merely when you touch file permissions.

subject and issuer identify the CN and signing CA. A new issuer after migration may require updated chain files or OCSP stapling refresh. When SAN coverage is wrong, browsers show name mismatch even if dates are valid—this guide focuses on expiry but log subjectAltName when triaging mixed incidents.

apachectl -S output lists name-based vhosts and default catches. Wrong SNI can show a renewed default certificate while the customer hostname still serves an expired VirtualHost that marketing DNS still points at.

Common mistakes

Renewing on an ACME host while production Apache on another machine still serves the old PEM. File sync without reload leaves workers holding expired mmap content.

Pointing SSLCertificateFile at a one-time copy under /etc/ssl/httpd/certs instead of live symlinks certbot maintains. Every renew updates live; copies go stale until someone remembers to recopy.

Running graceful only on the system default httpd instance while a container or second package namespace serves port 443 on the same IP via capabilities you forgot to inventory.

Skipping configtest because an unrelated vhost has a typo, then wondering why deploy hooks exited non-zero while cron reported renew success.

Trusting internal health checks that TLS-passthrough to backends without validating the public hostname certificate end users negotiate.

SELinux or permission changes blocking httpd from reading new keys after renew—error logs mention permission denied on key files even when dates on a world-readable cert look fine if you only inspected the leaf.

When to use automation

Disk checks and green ACME logs do not prove strangers see a fresh notAfter. ssldays reads the live TLS certificate your hostname presents—issuer, SANs, chain trust, and expiry—the same vantage an external shopper or API client uses.

Schedule monitoring with alerts at 30, 14, 7, and 1 days before expiry, once per threshold per renewal cycle. Email alerts apply on all plans; Slack and Discord webhooks are available on paid Starter and Pro tiers. Free accounts monitor 3 domains with daily checks; Starter covers 25 domains hourly and Pro 100 hourly. Pair TLS watching with RDAP registrar expiry where published so domain billing does not block the next validation pass.

After you close the incident, add the production hostname to monitoring so the next apache ssl certificate expired page becomes a ticket days earlier, not a Sev1 at midnight.