Why does renewal fail when the site works fine?

The validation path is usually the problem, not the site. A blanket HTTPS redirect or a bot filter can block the challenge while every normal page serves correctly.

Can a CAA record break renewal?

Yes. Authorities are required to refuse issuance when the record excludes them, and the break appears at the next renewal rather than when the record is added.

When should a certificate expiry alert fire?

Two to three weeks out, with a separate alert on renewal-job failure. Expiry monitoring alone finds the problem far later than the job logs would.

Questions

Why did my certificate renewal fail?

Automated renewal validates domain control before issuing, and anything that blocks that validation stops the renewal — usually a redirect rule, a CAA record, a firewall, or DNS credentials that expired. The failure happens weeks before the certificate does, produces no visible symptom, and is discovered on the day the site stops loading. That gap is the real problem, and monitoring closes it.

Cause one — the validation path is blocked

HTTP validation requires the authority to fetch a token at `/.well-known/acme-challenge/`. Anything intercepting that path breaks it.

A blanket HTTP-to-HTTPS redirect applied before the challenge path is served is the most common version, and it looks like correct configuration.

A firewall or bot filter refusing the authority's request, which arrives from addresses that look automated because they are.

A server configured to hide directories whose names begin with a dot, which makes the whole `.well-known` tree unreachable.

Test it by placing a file at that path and fetching it over plain HTTP from outside your network.

Cause two — a CAA record excludes the authority

A CAA record lists which certificate authorities may issue for the domain, and every publicly trusted authority is required to check it and refuse when excluded.

Adding one without listing the authority your automation uses breaks renewal at the next attempt rather than immediately.

`dig example.com CAA +short` shows the records. An empty answer means no restriction, which is why renewal worked before the record was added.

Authorities check up the tree, so a record at the apex applies to subdomains that publish none of their own.

List every authority that issues for the domain, including the one behind a CDN or a hosting platform that provisions certificates automatically. Omitting one breaks a renewal you did not know existed.

Cause three — DNS validation credentials

Wildcard certificates require a DNS-based challenge, which means the renewal process needs credentials to write a TXT record.

Those credentials expire, get rotated, or lose permission when a DNS provider changes its API — and none of that produces an alert.

The renewal then fails at the point of publishing the token, which is invisible from the site.

Scope the credentials narrowly rather than broadly, and record their expiry alongside the certificate's.

Cause four — the automation itself stopped

A scheduled job removed during a server rebuild, a container image that no longer includes the client, a disk that filled.

A client version that stopped working against the authority's current protocol, which happens on long-lived servers nobody touches.

Rate limits at the authority after repeated failed attempts, which turn a fixable problem into a temporary refusal.

The common thread is that the renewal is infrastructure nobody looks at until it fails.

A hostname removed from the certificate request without being removed from the server configuration, which makes the issued certificate stop covering a name still in use.

Closing the gap between failure and expiry

Monitor the certificate's remaining validity from outside, as a check with an owner rather than as a line in a quarterly report.

Alert at a threshold that leaves room to act — two or three weeks, not two days.

Alert on renewal-job failure as well, which catches the problem weeks earlier than expiry monitoring does.

VeriFixScan reports `transport.certificate_details` with the validity window, `transport.certificate_coverage` for the names covered, and `dns.caa` for the records that can block issuance.

Reading those three together is what turns a renewal failure into something you find before a visitor does.

Frequently asked questions

Why does renewal fail when the site works fine?: The validation path is usually the problem, not the site. A blanket HTTPS redirect or a bot filter can block the challenge while every normal page serves correctly.
Can a CAA record break renewal?: Yes. Authorities are required to refuse issuance when the record excludes them, and the break appears at the next renewal rather than when the record is added.
When should a certificate expiry alert fire?: Two to three weeks out, with a separate alert on renewal-job failure. Expiry monitoring alone finds the problem far later than the job logs would.

Sources

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website