Quick Summary: If your Let's Encrypt SSL certificate fails to renew automatically in Plesk, it is usually because your domain's primary DNS A record is not pointing to your hosting server's IP address. Learn how automated validation works, how to fix it, and why automated renewals are becoming essential across the web.

How Let's Encrypt Automated Renewals Work

Let's Encrypt uses an automated challenge process called HTTP-01 Domain Validation to confirm that you own a website before issuing or renewing an SSL certificate.

1. The Automated Request: Approximately 30 days before your certificate expires, Plesk runs an automated background task requesting a renewed SSL certificate.

2. The Security Challenge: Let's Encrypt places a temporary token in a hidden directory on your web server:

   (http://yourdomain.com/.well-known/acme-challenge/)

3. The DNS Verification: Let's Encrypt queries public DNS records to find your domain's A Record. It then connects directly to that server IP address to read the token file.

Why Auto-Renewal Fails:

If your domain's A record points to an external server IP, a third-party proxy, or an outdated DNS record, Let's Encrypt will try to check the token on the wrong server. The challenge fails, and the automated renewal aborts.

Step-by-Step Fix

To ensure your Let's Encrypt certificates renew automatically without manual intervention:

1. Check Your Server IP: Log into your Plesk Hosting Dashboard and note your server's assigned IPv4 address.

2. Verify Your DNS A Record: Use DNS Checker to verify where your domain points globally.

3. Update Your A Record: In your Domain Management Panel, ensure both your root domain (@) and www alias point directly to your hosting server's IP address.

Industry Alert: The Shift from 90-Day to 45-Day Certificates

As required by the CA/Browser Forum Baseline Requirements, all publicly trusted Certificate Authorities—including Let's Encrypt—are reducing SSL certificate validity periods to improve global web security.

According to the official announcement, Let's Encrypt: From 90 to 45 Days, the rollout timeline is as follows:

• Current Standard: Certificates are valid for 90 days (with automated renewals triggering every 60 days).

• May 13, 2026: Let's Encrypt introduces the 45-day tlsserver profile for early adopters and testing.

• February 10, 2027: Default certificate validity drops to 64 days (with a 10-day authorization reuse window).

• February 16, 2028: Default certificate validity drops to 45 days (with authorization reuse shrinking to 7 hours).

What This Means for You:

Manual SSL renewal will no longer be practical as certificate lifetimes shorten. Ensuring your domain's DNS is correctly pointed so that automated renewal tasks can run smoothly in the background is the most effective way to keep your website secure and avoid downtime.

Helpful Official Resources & Links

• Official Announcement: Let's Encrypt — From 90 to 45 Days Policy Update

• Frequently Asked Questions: Let's Encrypt FAQ

• Monitoring Options: Let's Encrypt Monitoring Service Options

• Community Help Forum: Let's Encrypt Community Support