View a markdown version of this page

Certificate did not automatically renew - Amazon Lightsail
Option 1: Restart Lightsail Setup (Recommended)Option 2: Renew your certificate manually

Certificate did not automatically renew

Lightsail Setup configures automatic renewal of your Let's Encrypt SSL/TLS certificate. If your website displays a security or certificate error, your certificate might not have renewed automatically.

Important

If your certificate was issued before August 9, 2026, your certificate will not renew automatically. Restart Lightsail Setup (Option 1) to renew your certificate and restore automatic renewal. You can find when your certificate was issued on your WordPress instance's Connect tab.

Certificate issue date displayed on the Connect tab in the Lightsail console.

The following image shows an example of a certificate error in Chrome (this might vary for different browsers).

SSL certificate error displayed in a web browser.

Option 1: Restart Lightsail Setup (Recommended)

Restart Lightsail Setup with the same domain and DNS configuration as your previous setup. This regenerates your certificate and restores automatic renewal. To restart Lightsail Setup, complete the following steps:

  1. Open the Lightsail console at https://lightsail.aws.amazon.com/.

  2. Choose your WordPress instance from the instance list.

  3. Choose the Connect tab and choose Restart setup.

    The Restart setup button on the Connect tab in the Lightsail console.

  4. Complete the setup using the same domain and DNS configuration as your previous setup.

After Lightsail Setup completes, your certificate is renewed and automatic renewal is restored.

Option 2: Renew your certificate manually

Step 1: Check if your certificate has expired

Connect to your instance by using the Lightsail browser-based SSH client.

Run the following command to check the certificate status:

$ sudo certbot certificates

If the expiry date shown in the output is in the past, your certificate has expired and automatic renewal has failed. Continue to Step 2.

Step 2: Re-enable automatic renewal

The Lightsail blueprint uses a systemd timer to automatically renew the certificate. If this timer is inactive or disabled, the certificate will not renew automatically.

Run the following command to check the status of the renewal timer:

$ sudo systemctl status certbot-renew.timer

If the timer is active, you should see output similar to the following:

Output of the certbot-renew.timer status command showing the timer is active.

If the timer is not active or the command returns an error, run the following command to re-enable it:

$ sudo systemctl enable --now certbot-renew.timer

Re-enabling the timer restores automatic renewal for future renewals, but does not renew the certificate immediately. If your certificate has already expired, continue to Step 3.

Step 3: Manually renew the expired certificate

Run the following commands to stop the web server, force a certificate renewal, and restart the web server:

$ sudo systemctl stop apache2
$ sudo certbot renew --force-renewal
$ sudo systemctl restart apache2