DirectAdmin SSL certificate expired

directadmin ssl certificate expired means the listener serving that user domain still has a past notAfter—fix DirectAdmin's ACME/Let's Encrypt flow or install a renewed PEM, then reload.

Agencies and hosts running DirectAdmin manage per-user vhosts on nginx or Apache with optional Let's Encrypt integration.

Admins may see expired certs on the server hostname, user domains, or merged wildcard setups. User-level SSL Certificates UI differs slightly by skin but shares the same renewal backend.

External openssl on the customer domain comes before editing CMS configs.

First response

Log into DirectAdmin as the affected user → Account Manager → SSL Certificates (or Advanced Features → SSL Certificates). Note whether Let's Encrypt auto-renew is enabled and last renewal timestamp.

As admin, check Admin Level → SSL Certificates for the shared server certificate if errors hit the panel itself on port 2222.

Run openssl on the public website hostname; paste results into your ticket before bulk-editing nginx custom templates.

DirectAdmin skins rename menu paths; search SSL Certificates across user and admin levels. Capture whether nginx or OpenLiteSpeed terminates TLS because rewrite_conf behavior differs. Note customized httpd.conf fragments that survive panel updates.

What this error means

DirectAdmin writes certificate paths into per-domain configs (/usr/local/directadmin/data/users/USER/domains/DOMAIN.cacert). When renewal fails, the old files remain referenced until ACME succeeds and the panel triggers a web server rewrite.

Admin SSL (hostname) and user domain SSL are separate objects. Fixing user storefront TLS does not automatically refresh the control panel cert traders use to log in.

Browsers enforce leaf expiry regardless of whether you purchased DV from the panel or pasted a commercial bundle.

Each user domain stores certificate metadata beside virtual host files. Expiry is a file and reload problem even when Let's Encrypt UI shows success. Admin login on port 2222 uses a separate cert that can expire while customer sites run.

Common causes

Custom nginx templates hardcode old ssl_certificate paths bypassing DirectAdmin's rewrite.

Let's Encrypt disabled after a one-time manual upload.

Punycode/IDN domains failing validation while ASCII alias expired.

Mail subdomain (mail.domain.com) included in site cert without renewal coverage.

Insufficient cron for directadmin letsencrypt task on overloaded nodes.

Resellers cloning users without copying LE settings inherit expired manual uploads. Mail-only subdomains included in web certs may fail validation when HTTP routes differ.

Confirm from the outside

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Replace HOST with the public hostname users type.

How to read the output

After renewal, compare file mtimes under the user's domains directory with the serial presented on :443.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

DirectAdmin CLI

cd /usr/local/directadmin/custombuild
./build rewrite_conf

Force renew (typical install):

/usr/local/directadmin/scripts/letsencrypt.sh request_single USER DOMAIN

Check /var/log/directadmin/error.log and /var/log/httpd/domains/ for domain-specific errors.

Openssl each domain alias from the customer list, not only marketing primary. Compare file mtimes under user domains directory with external serial numbers.

Fix checklist

1. Enable Free & automatic certificate from Let's Encrypt for the domain.
2. Resolve ACME errors shown in the panel log viewer.
3. Run letsencrypt.sh request_single if UI is stuck.
4. ./build rewrite_conf and confirm nginx/Apache reload.
5. Renew admin hostname cert separately if DA login warns.
6. Verify webmail and FTP TLS if they share the cert.
7. Add external monitoring on each production domain.
8. Remove duplicate manual certs conflicting with LE.

Roll out and verify

DirectAdmin clusters sometimes run custom nginx builds where rewrite_conf takes longer on busy nodes—announce maintenance if admin SSL on port 2222 is also expiring, because technicians cannot log in to fix user domains without fixing admin first.

User-level and admin-level certificates should renew in separate change tasks. Document absolute paths from domains/DOMAIN.cacert in tickets so the next shift can grep configs without panel access.

After letsencrypt.sh request_single, validate both IPv4 and IPv6 listeners if you publish AAAA records. DirectAdmin can install a cert on one stack while an alternate IP still serves the expired default for misconfigured resellers.

Keep a tarball of last-known-good PEMs only for rollback drills, not as the production renewal strategy—long-lived backup certs hide stale live presentment.

After rewrite_conf, spot-check phpMyAdmin and webmail TLS. Update customer runbooks distinguishing user-level versus admin-level renewal.

DirectAdmin documentation still evolves around OpenLiteSpeed versus nginx selection—verify which binary serves port 443 before editing templates. CustomBuild options can pin older OpenSSL branches that reject modern intermediates; if openssl verifies off-box but browsers complain about dates only, you are still in expiry territory rather than chain trust territory. Snapshot user bandwidth and quota settings because aggressive bots hammering ACME paths sometimes triggers temporary firewall rules that block future renewals. Communicate with end users when shared IP certificates rotate because cached HSTS headers may lengthen perceived recovery even after notAfter advances. Reseller agreements should state whether the reseller or tenant buys commercial OV for branded hosts versus relying on included Let's Encrypt automation.

When to use automation

Certificate files on disk and green panels lie until a stranger's TLS handshake succeeds. Schedule live checks on the exact hostname shoppers or API clients resolve, including redirects and the certificate presented after your platform edge terminates the connection. Pair TLS notAfter with RDAP domain registration data so revalidation is not blocked by registrar billing.

Run a one-shot proof on /check, then add the production hostname to monitoring with alerts at 30, 14, 7, and 1 day thresholds. ssldays reads the live chain external users see—useful when shared hosting, PaaS edges, or CMS layers each claim TLS is fine.