An expired SSL certificate takes a website down just as completely as a server crash, except it also shows visitors a scary security warning. It is also entirely preventable: Let's Encrypt issues free certificates, and Certbot automates renewal, so a certificate should never expire if the automation is set up and checked once. This guide covers setup, renewal, and the checks that catch problems early.

The setup below assumes a Linux server running Nginx or Apache, which covers most small projects. If you use a hosting platform, check whether it already manages certificates for you before doing this manually, because double-managing certificates causes its own problems.