SSL certificate error

Quick answer: Browser certificate warnings come in three flavors: expired (renew it), name mismatch (the certificate does not cover this exact domain/subdomain), and incomplete chain (intermediate certificate missing — desktop browsers may work while phones and curl fail). openssl s_client shows which one you have in seconds.

Overview

An SSL error rarely means anything is "hacked" — it is almost always certificate lifecycle management: renewal failed, the wrong certificate is served, or the chain is served incompletely. Identify the exact failure before touching configs.

Before you start

• The exact domain (with/without www matters) and SSH access to the server.

Step-by-step guide

1. Inspect what the server actually serves:

   echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates -subject -ext subjectAltName

   Check notAfter (expiry) and that the SAN list contains the exact hostname visitors use.
2. Expired? Renew and reload:

   sudo certbot renew
   sudo systemctl reload nginx

   If renewal fails, run sudo certbot renew --dry-run and read the error — usually port 80 blocked or DNS changed. See renewing Let's Encrypt.
3. Name mismatch? Issue a certificate covering all needed names (apex + www, or the missing subdomain) — see installing a free SSL certificate.
4. Chain problems? Serve the full chain file (fullchain.pem, not cert.pem) in the web server config.
5. After any fix, verify from outside again (step 1) — browsers cache certificate errors aggressively; test in a private window.

Common issues

• Auto-renew silently broken for months: the timer runs but validation fails — the dry-run reveals it.
• Different certificate on IP vs domain: SNI — always test with -servername.
• Works on desktop, fails on mobile: the classic incomplete-chain signature.
• Mixed content warnings after fixing SSL: that is a different issue — http:// resources on an https page.

When to contact support

Certificates on an unmanaged server are customer-side, but if port 443 seems blocked from outside while the service listens, or you use a panel whose SSL automation misbehaves, open a ticket with the openssl output.

Frequently asked questions

Why does the site work on desktop but show SSL errors on phones?

That is the classic incomplete certificate chain: desktops often cache intermediates, phones and curl do not. Serve fullchain.pem instead of only the certificate file and reload the web server.

My certificate expired although renewal is automatic — how?

The renewal timer can run while validation silently fails, for example when port 80 is blocked or DNS changed. Run certbot renew --dry-run to see the real error and fix that path.

Related articles

• How to renew a Let's Encrypt SSL certificate
• How to install a free SSL certificate
• Website is down: first steps
• How to collect logs for support

Need a hand? Contact Cloud2Y support →