certbot certificates shows a certificate valid until 18/12: the renewal on 19/09 succeeded.
But nginx reads /etc/nginx/ssl/boutique.crt, a copy from 21/07 that expired on 18/10. The script
copie-nginx.sh, responsible for copying it after each renewal, has been failing since 19/09 with
“Permission denied” (code 126): the restore of 06/09 removed its execute bit.
nginx runs normally (with -k the site responds) and the clock is correct (the certificate really did expire on 18/10).
Incident resolved
Analysis and fix
Clean fix: point nginx directly to certbot's files
(ssl_certificate /etc/letsencrypt/live/boutique.tifawt-argan.ma/fullchain.pem; and privkey.pem), then
nginx -t and systemctl reload nginx. Check with openssl s_client … | openssl x509 -noout -dates.
Prevention:
- no more copies: nginx reads
/etc/letsencrypt/live/…and a deploy hook only runssystemctl reload nginx; - monitor the expiry date of the certificate actually served (HTTPS probe, alert at 21 days), not just the certbot timer;
- after a restore, check the scripts' permissions (
chmod +x).