What should be checked?
Check the certificate presented by the public HTTPS endpoint, its expiry date, and whether it matches the requested hostname. Include the names visitors actually use, such as the main domain and any important subdomain. The installed file on your server is not necessarily the certificate that visitors receive through a proxy or CDN.
Why can renewal still fail?
Automatic renewal depends on a working challenge, DNS or HTTP routing, and a deployment path that loads the new certificate. A successful renewal job does not by itself prove that the public endpoint now serves the renewed certificate. Recheck from outside after the change.
- Confirm the public endpoint and hostname.
- Investigate renewal or proxy configuration before expiry.
- Recheck the endpoint after the fix.
How Guardian helps
Guardian watches the public TLS endpoint for verified domains and opens an evidence-backed incident when its rules detect an expiry problem. It can guide a response and verify a later observation. It does not renew certificates or guarantee that every client accepts a certificate.
Example: renewal succeeded but visitors still see a warning
The certificate authority issued a new certificate, yet the CDN continues to serve the old one. In that case, repeating the renewal command is unlikely to help. Inspect which certificate the public endpoint presents, then check the CDN or load balancer deployment. After updating it, verify the same hostname from outside your network. The public observation matters more than the date printed by a local certificate file.