Why are notifications from Let’s Encrypt received when SSL/TLS support is disabled for domain?

Question

Why are notifications from Let's Encrypt received when SSL/TLS support is disabled at Domains > example.com >Hosting Settings?

Answer

Let's Encrypt extension is using delayed notifications.
Even when the SSL/TLS is disabled, the notifications can still be sent for a few days, while they're stored in the "pending" state in the database.

To check the state of notifications in the database follow the next steps:

1. Connect to the server via SSH.

2. Access the Let's Encrypt database:

   # sqlite3 /usr/local/psa/var/modules/sslit/sslit.sqlite3

3. Run the following command to check last 10 notifications and their state:

   select id,createdDate,state,params from Notification where params like '%example.com%' order by id desc limit 10;

   Note: replace example.com with the required domain name.