How to Fix SSL Certificate Errors on Linux Server

SSL errors cause browser warnings that drive visitors away instantly. Most SSL issues have quick fixes — this guide covers every common SSL error on Linux servers.

Step 1 — Check Certificate Status

# Check expiry date
echo | openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates

# Check certificate details
sudo certbot certificates

Step 2 — Fix Expired Let's Encrypt Certificate

# Manual renewal
sudo certbot renew --force-renewal

# Test renewal without applying
sudo certbot renew --dry-run

# Renew specific domain
sudo certbot renew --cert-name yourdomain.com

Step 3 — Fix Auto-Renewal Not Working

# Check renewal timer
sudo systemctl status certbot.timer

# Check cron job
sudo crontab -l | grep certbot
cat /etc/cron.d/certbot

# Test renewal hook
sudo certbot renew --dry-run --pre-hook "nginx -t" --post-hook "systemctl reload nginx"

Step 4 — Fix Mixed Content Warnings

# Find HTTP resources in WordPress
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tables

# Add HTTPS redirect in Nginx
server {
    listen 80;
    server_name yourdomain.com;
    return 301 https://$server_name$request_uri;
}

Step 5 — Fix Certificate Chain Issues

# Check chain
openssl s_client -connect yourdomain.com:443 -showcerts 2>/dev/null | grep "s:\|i:"

# Use fullchain.pem not cert.pem in Nginx
ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
# NOT: ssl_certificate /etc/letsencrypt/live/yourdomain.com/cert.pem;

Step 6 — Fix acme.sh SSL Renewal

# Force renew with acme.sh
~/.acme.sh/acme.sh --renew -d yourdomain.com --force

# Check acme.sh cron
crontab -l | grep acme

Conclusion

SSL errors need immediate fixing to prevent visitor loss. Our team provides emergency SSL certificate support with immediate resolution.