Users cannot open the site: certificate or DNS?

Troubleshooting, Easy

You are on call. At 08:10 on Sunday customers write that shop.example.org does not open. Support says browsers show "Your connection is not private". You know: - It started at about 00:00 UTC. Before that, the site worked. - The monitoring tool, which checks the site from outside, started to fail at the same time with a TLS error. The home page returns 200 when you call the server by its internal address without TLS. - dig +short shop.example.org returns 203.0.113.40, which is the load balancer's address, as it has been for months. - The certificate came from a free certificate authority 90 days ago. The certificate is installed on the web server itself (not on the load balancer, which only passes traffic through). A cron job on that server runs the renew command every night. - A firewall rule was changed 5 weeks ago. Nobody connected it to this site. Say what you check, in order, with the evidence each check gives. Then say the cause, the fix, and how you confirm and prevent it.

Examples

Input

openssl s_client -connect shop.example.org:443 -servername shop.example.org </dev/null | openssl x509 -noout -dates -subject

Output notBefore=Jul 27 00:00:00 2026 GMT, notAfter=Oct 25 00:00:00 2026 GMT, subject=CN=shop.example.org

Why Shows which certificate the server presents, its dates and its name. Compare the dates with the time the errors began.

Input sudo tail -n 20 /var/log/letsencrypt/letsencrypt.log

Output The last entries are nightly renew runs. Each run for the last 29 days ends with an error line.

Why Shows what the renew job did on recent nights. Read the error to see what it was.

Input Decoy: dig +short shop.example.org

Output 203.0.113.40

Why The name points to the load balancer, as before. This does not show what certificate the server presents.

Constraints

You have shell access to the server and read access to DNS. The renew cron job runs as root.
Rotating the certificate is allowed. Changing DNS is allowed but not needed unless the checks show it.
Do not turn off TLS or tell users to ignore the warning.

Your answer must contain

An ordered list of checks, and the evidence each check gives
How you tell an expired certificate from a DNS problem
The cause, the fix and how you confirm it
What you change so it does not happen again