TLS & Certificates
Let's Encrypt, certbot, renewals and chain problems.
22 articles
Your Cert Automation Should Default to Let's Encrypt Staging
Five test renewals can exhaust the duplicate certificate limit and block a real renewal for a week. Here is why certbot drifts to production, and the directory split that prevents it.
Certbot connection refused on http-01: diagnosing proxies, IPv6 and port 80
Connection refused is not the same as a timeout, and the difference tells you exactly where to look. A diagnostic order for failed Let's Encrypt http-01 challenges.
Nginx Reverse Proxy, TLS and Rate Limiting: The Config You Should Actually Be Running
A one-line proxy_pass is not a reverse proxy. Real timeouts, correct forwarded headers, a Mozilla-grade TLS block and limit_req zones that stop credential stuffing without breaking your own app.
Certbot http-01 Fails Behind Your Force-HTTPS Redirect: It Is Not HSTS
Let's Encrypt follows your 301 to HTTPS and ignores HSTS entirely. So the real cause of a failed http-01 renewal is one of four things, and disabling HSTS is not the fix.
Certbot renewal fails silently: alerting before the certificate expires
Certbot can fail twice a day for three months without telling anyone, and Let's Encrypt stopped sending expiry emails in 2025. Three independent alerts that catch it, with the tests.
"Too Many Certificates Already Issued": Fixing Let's Encrypt Rate Limits
The duplicate certificate limit is 5 per exact name set per week and global across all accounts, so switching clients cannot help. Here is what actually works.
'Unable to get local issuer certificate': fix the chain, not the client
The site works in Chrome and fails everywhere else. That is an incomplete nginx certificate chain, and the fix is fullchain.pem, not curl -k or disabling verification.
ACME TLS Handshake Failure Behind a Load Balancer: When Only Some Backends Answer
Cert renewals fail intermittently behind a load balancer while normal traffic is fine. The cause is not certbot; it is inconsistent backends. Here is the diagnosis and fix.
The asyncio SSL Memory Leak Nobody Warns You About, and How to Work Around It
Long-running asyncio TLS services can leak memory in the SSL transport, growing RSS until the OOM killer strikes. Here is how to confirm it, mitigate it, and track the real fix.
Certbot Keeps Making New Certificates Instead of Renewing: --cert-name Explained
Certbot identifies a certificate by its lineage name, not its domain list. Here is why it spawns duplicate -0001 certs and how --cert-name fixes it for good.
Your DDNS subdomain keeps hitting Let's Encrypt rate limits, and it is not a bug
If certificates fail on a shared DDNS suffix like duckdns.org, you are sharing one rate-limit bucket with every other customer. Here is why, and the only real fix.
The HSTS Preload List Is Almost One-Way: Check This Before You Submit
Preloading HSTS hardcodes your domain into browsers with no server-side undo. Why every subdomain and expired cert becomes a forever problem, and the checklist to run before you commit.
x509 Certificate Signed by Unknown Authority on the ingress-nginx Admission Webhook: The Real Fix
An x509 trust error on the ingress-nginx or cert-manager admission webhook blocks every Ingress cluster-wide. The cause is a drifted caBundle. Patch it, do not delete the webhook.
Let's Encrypt Renewal Fails Behind Cloudflare Proxy: Use DNS-01, Not http-01
Cloudflare's orange-cloud proxy breaks http-01 ACME challenges. You do not have to grey-cloud your site. Switch to DNS-01 over Cloudflare's API and renew with the proxy on.
Certbot Bypasses systemd for Nginx: Why Renewals Leave Them Out of Sync
Certbot's nginx plugin signals nginx directly instead of via systemctl, so systemd's state drifts from reality after renewal. Here is the PID-file race and the fix.
When Certbot's nginx Plugin Mangles Your Server Block, Fix It by Hand
Re-running certbot --nginx to fix a broken server block usually makes duplicate, conflicting blocks. Use certonly and wire the SSL directives in yourself.
DNS-01 Fails but the TXT Record Is There: Delegate _acme-challenge
DNS-01 validation keeps failing with NXDOMAIN even though your TXT record exists. It is a delegation problem, not propagation. Delegate _acme-challenge via CNAME to fix it for good.
Let's Encrypt Renewal Fails Behind Cloudflare Proxy: Use DNS-01, Not http-01
Cloudflare's orange-cloud proxy breaks http-01 ACME challenges. You do not have to grey-cloud your site. Switch to DNS-01 over Cloudflare's API and renew with the proxy on.
Two ACME Clients, One Domain: Handling Multiple _acme-challenge Records Safely
When two ACME clients share a domain, DNS-01 renewals fail intermittently and people delete each other's TXT records. Here is why a name holds many TXT records and how to make the clients coexist.
Certificates for a Multi-Server Cluster: Issue Once, Distribute Everywhere
Running certbot on every node for the same domain burns your Let's Encrypt rate limit and splits your cluster's identity. Issue once with DNS-01 and distribute instead.
Old Android and OpenSSL Clients Failing TLS After the Root CA Transition
TLS works in every browser but fails on old Android and ancient OpenSSL. It is a client trust-store issue, and the DST Root CA X3 workaround is now dead.
6-Day Certificates Are Here: Auditing Renewal Automation That Assumed 90 Days
Let's Encrypt short-lived certs live 160 hours, not 90 days. Your weekly cron and 30-day expiry alert are now an outage. Here is the audit that fixes both.