Verifying and renewing

Reload the server, then check what it actually presents — not what you believe you installed. The distinction matters: a config that loads without error can still be serving the wrong file.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

The Domain SSL Checker on this site does the same handshake and flags the failures that a browser will not show you:

Chain complete? The Certificate Chain section should show leaf plus intermediates. One certificate alone means the intermediate is missing.
Every hostname covered? Compare the SAN list against every name you serve — apex, www, and any subdomain.
Right certificate? Check the fingerprint against the file you meant to install.
Nothing unexpected issued? The CT Log Search tool lists every certificate any CA has issued for your domain.

Same certificate, same lifetime. The only difference is whether renewal is something that happens or something someone has to remember — and lifetimes are getting shorter every year.

Renewal is the part that bites

Certificate lifetimes are shrinking fast. The CA/Browser Forum ballot SC-081 steps the maximum down in three: 200 days since March 2026, 100 days from March 2027, and 47 days from March 2029. The first step has already landed. Manual annual renewal is on its way out — if a human has to remember, it will eventually be forgotten.

Automate it, or at minimum alert on it. An expiry that surprises you is an outage.
Test the renewal, not just the issuance — certbot renew --dry-run catches a broken hook before it costs you a weekend.
Watch the intermediates too. They expire independently of your leaf, and a CA rotating one has broken sites before.
Publish a CAA record so that only the CA you actually use is allowed to issue. Check the current state with the CAA Record Lookup tool.