Let’s Encrypt renewal fails after host switch
By Daniel Brooks Published 7 min read
On this page (9 sections)
- The short version
- Why Let’s Encrypt renewal fails after switching hosts
- Check your webroot path and renewal config first
- How DNS and domain validation block renewal
- What server settings or permissions to verify after host change
- How to check Certbot or client logs for errors
- When to reissue certificates versus fixing config
- How to stop Let’s Encrypt renewal failures after switching hosts
- Questions people still ask
In short: If your Let’s Encrypt auto renewal fails after switching hosts, check the webroot path, DNS records, server permissions, and Certbot logs. The renewal usually breaks because the old webroot or DNS points to the previous host, causing validation to fail.
Part of our guide on wordpress login not working after password reset
A clear four-step checklist reveals precisely why Let’s Encrypt renewal fails after host switching and what to fix first.
| Webroot path | must match current host |
|---|---|
| DNS update time | up to 48 hours |
| Certbot logs location | /var/log/letsencrypt |
| Typical permission | 755 folders |
| Cert renewal period | every 60 days |
The short version
- Renewal fails mostly when the renewal uses an old webroot path or outdated DNS records.
- Check server folder permissions and ownership; incorrect settings block certificate updates.
- DNS must point to the new host for domain validation to succeed during renewal.
- Certbot logs provide exact error messages to identify the renewal problem.
- Reissue certificates only if fixing configs doesn’t resolve renewal errors.
Why Let’s Encrypt renewal fails after switching hosts
Imagine you switched your website to a new host but your Let’s Encrypt renewal suddenly stops working. The system tries to renew certificates at the old webroot or with outdated DNS details. It fails domain validation and won’t update SSL.
Most renewal failures after switching hosts happen because Let’s Encrypt’s renewal process still targets files or IPs on the previous server. The automated client uses stored configurations that don’t match the new hosting environment.
Four main causes block renewal: the renewal webroot points to the old server, DNS records have not switched to the new IP, server file permissions prevent renewal challenges from completing, and renewal logs show errors but go unnoticed.
- Webroot path still references old host directories
- DNS records delay or misdirect domain validation
- Server permissions block access to renewal challenge files
- Renewal client logs reveal specific errors needing fixes
Check your webroot path and renewal config first
Say your renewal failed because it tries to place validation files in a directory that no longer exists on your new host. The renewal client’s webroot path still points to the old host’s folder. If that sounds like your situation, read up on how to monitor spam traps and sender reputation next.
Let’s Encrypt uses a webroot plugin to put challenge files in a specific directory under your website root. After switching hosts, this path must reflect the new server’s structure exactly.
Check your renewal config file. It usually lives in /etc/letsencrypt/renewal/yourdomain.conf. Look for the webroot_path setting. It should match the actual webroot folder on your new host.
Fix any mismatch by updating the webroot path to the new host's correct document root. Then run a manual renewal test using certbot renew --dry-run to verify the fix. People in this spot often ask about checking dns records as well.
- Locate your renewal config file for your domain.
- Open it and find the
webroot_pathline. - Confirm this path exists on your new host and is writable.
- Update the path if outdated to the current webroot.
- Run
certbot renew --dry-runto test renewal.
How DNS and domain validation block renewal
Picture your DNS records still pointing to your old hosting IP address days after switching. Let’s Encrypt contacts the IP in DNS to verify domain control. If that IP is old, validation fails.
DNS changes can take up to 48 hours to fully propagate worldwide. If you try renewing SSL during propagation, Let’s Encrypt will check the wrong server.
Verify your domain’s A record points to the new host IP. Use tools like dig or online DNS checkers to confirm. We go through cpanel login problems on bluehost wordpress step by step elsewhere on the site.
If DNS is incorrect, update it at your domain registrar. Wait for propagation to complete before renewing certificates again.
- DNS A record must point to the new server’s IP
- Propagation delay can cause validation to fail temporarily
- Use DNS check tools to confirm correct IP address
- Switching DNS too quickly triggers renewal errors
What server settings or permissions to verify after host change
Imagine renewal fails because Let’s Encrypt cannot create or access the .well-known/acme-challenge/ folder on your server. Permissions block the process.
Your web server user must have read and write permissions to the webroot directory and the .well-known path. Usually, directories need 755 permissions, and files 644. The other half of this decision is how to fix websites loading slow.
Check ownership of these folders. The web server user (often www-data or apache) needs ownership or group rights.
Incorrect permissions or ownership means renewal challenges return 403 or 404 errors, causing certificate renewals to fail.
- SSH into your new host server.
- Navigate to your website’s webroot folder.
- Check permissions with
ls -lon the.well-known/acme-challengepath. - Set permissions to
755for directories and644for files. - Change ownership to the web server user if needed using chown.
- Test server access to a test file in
.well-knownvia browser.
How to check Certbot or client logs for errors
Say you ran renewal commands but they failed silently or with vague errors. Certbot logs hold the detailed error messages you need. It helps to understand limits of free hosting offers before going further.
On most Linux hosts, Certbot logs reside in /var/log/letsencrypt/letsencrypt.log. This file records each renewal attempt and the exact reason for failure.
Open the latest log after a failed renewal. Look for keywords like challenge failed, connection refused, or permission denied.
The log tells if renewal failed due to DNS issues, webroot access, or client misconfiguration. Use these messages to focus your troubleshooting.
- Locate the Certbot log at
/var/log/letsencrypt/letsencrypt.log. - Open the log with a text viewer like less or
tail -n 50. - Search for the date and time of your last renewal attempt.
- Identify error messages related to domain validation or file access.
- Adjust your server or DNS based on the log errors.
When to reissue certificates versus fixing config
Imagine you fixed permissions, webroot, and DNS but renewal still fails. Sometimes, the stored certificate or renewal config itself is corrupted or outdated.
Reissue certificates when the current ones are close to expiry and renewal repeatedly fails despite correct settings.
Reissuing means requesting a brand new certificate rather than renewing the old one. Use certbot certonly with the correct options and webroot.
If renewal errors stem from configuration leftovers from the old host, reissue clears these conflicts and resets renewal hooks for the new environment.
- Fix config first: check webroot, DNS, permissions, logs
- Reissue certs if renewal fails repeatedly or config is damaged
- Use certbot certonly to request new certificates manually
- Reissue helps when migration caused config file mismatches
How to stop Let’s Encrypt renewal failures after switching hosts
Picture finishing your host switch with no renewal failures later on. The key is updating your renewal configuration to reflect the new environment immediately.
Always update webroot paths and confirm DNS points to the new IP before the SSL expiration date. Verify server permissions early.
Automate checking renewal with certbot renew --dry-run after migrating. This catches issues before certificate expiry.
Document your Let’s Encrypt configuration and renewal steps to save time on future changes.
- Update renewal config webroot promptly after host switch
- Confirm DNS propagation before renewal attempts
- Set correct permissions and ownership on webroot folders
- Test renewal manually before automatic cron jobs run
Questions people still ask
How can I find my current Let’s Encrypt renewal webroot path?
Check the renewal configuration file in /etc/letsencrypt/renewal/yourdomain.conf. The webroot_path setting shows the folder used during validation.
What DNS records must I update to fix renewal failures?
Update your domain’s A record to point to your new hosting server’s IP. This ensures Let’s Encrypt validates the domain on the correct host.
What permissions are needed on my webroot for Let’s Encrypt renewal?
Directories should usually have 755 permissions, and files 644. The web server user must own or have access rights to these folders.
Where can I find Certbot logs to diagnose renewal errors?
Logs are normally in /var/log/letsencrypt/letsencrypt.log. Review recent attempts there to see exact failure reasons.
When is reissuing certificates necessary instead of renewing?
If all config, permissions, and DNS are correct but renewal fails repeatedly, reissuing a new certificate resets the setup and often fixes residual issues.