One mismatch that bites hard: browser padlock expiry vs openssl s_client. Always pass -servername so SNI picks the right vhost; without it you often print the default cert. If a proxy or CDN terminates TLS in front of nginx, check the public edge on 443 and the origin separately. Also: updating cert files on disk does nothing until the listener reloads — run nginx -t then reload, and compare leaf notBefore/notAfter, not intermediates.