Fix SSL Certificate Errors

SSL certificate errors prevent users from accessing your website securely. This guide covers the most common SSL errors and how to fix them.

Check Certificate Expiry

$echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

notBefore=Jan 24 10:00:00 2026 GMT
notAfter=Apr 24 10:00:00 2026 GMT

Check days until expiry:

$echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2 | xargs -I{} date -d "{}" +%s | xargs -I{} bash -c 'echo "Days until expiry: $(( ({} - $(date +%s)) / 86400 ))"'

Error: Certificate Expired

Symptoms: Browser shows "Your connection is not private" with ERR_CERT_DATE_INVALID.

Resolution: Renew the Let's Encrypt certificate:

$certbot renew --force-renewal
$systemctl reload nginx

If auto-renewal is failing, check the Certbot logs:

$cat /var/log/letsencrypt/letsencrypt.log | tail -50

Error: Certificate Chain Incomplete

Symptoms: Certificate works in browsers but fails in some API clients or curl.

Check the chain:

$openssl s_client -connect example.com:443 -showcerts 2>/dev/null | grep "s:|i:"

Ensure your Nginx config uses fullchain.pem (not just cert.pem):

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

Error: Certificate Name Mismatch

Symptoms: ERR_CERT_COMMON_NAME_INVALID — the domain does not match the certificate.

Check the certificate's domain:

$echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

If the domain is not covered, obtain a new certificate:

$certbot --nginx -d example.com -d www.example.com -d api.example.com

Test SSL Configuration

Use the SSL Labs API to test your configuration:

$curl "https://api.ssllabs.com/api/v3/analyze?host=example.com&publish=off&all=done" | python3 -m json.tool | grep "grade|status"

Recommended Nginx SSL Configuration

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=63072000" always;

[!TIP] Run certbot renew --dry-run monthly to verify that auto-renewal is working before the certificate actually expires.