Identify the certificate and names
Record which certificate is expiring, the names it covers and whether it secures a website, the Plesk panel or mail services. These can use different bindings. Read the renewal error before replacing or deleting an existing certificate.
Confirm the affected DNS names resolve as intended and that the chosen ACME validation method can reach its challenge. HTTP validation requires the correct public request path to reach the expected server; DNS validation depends on the authoritative TXT record. A CDN, redirect, firewall or stale IPv6 record can change the path.
Check Plesk and the origin
Review the Plesk extension and server logs for the relevant attempt. Verify that the domain exists in the right subscription and that the extension is permitted to place or verify the challenge. For mail, ensure the certificate covers the hostname actually used by clients.
Make one targeted change and retry according to the provider's guidance. Repeated blind retries can encounter certificate-authority rate limits. Do not disable certificate validation on clients to hide a renewal problem.
Confirm the live endpoint
After renewal, verify the certificate served publicly for each relevant hostname, including the chain and expiry, from the client-facing path. Check the panel or mail binding separately from the website. Schedule monitoring with enough lead time to fix the next renewal and document the validation method.
Further reading
Read the official documentation. For help applying these checks, explore Clouvenix services.