SSL Certificate Expired? How to Fix It and Prevent It Next Time

A client messages you: "The site says it's not secure." Visitors see a full-page browser warning, forms stop converting, and search crawlers may struggle to reach the site. An expired SSL certificate is one of the most visible outages a website can have, and one of the most avoidable.

This guide walks through confirming the problem, fixing it, and making sure it does not return.

Step 1: Confirm the certificate has actually expired

Browsers show errors such as NET::ERR_CERT_DATE_INVALID (Chrome) or "Warning: Potential Security Risk Ahead" (Firefox). Do not assume, check the dates directly:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

Look at notAfter. If it is in the past, the certificate expired. If the date is in the future, you have a different problem (see below).

Step 2: Rule out look-alike errors

Not every certificate error is an expiry:

Wrong hostname. The certificate covers example.com but not www.example.com.
Missing intermediate certificate. Works in some browsers and fails in others.
Wrong certificate served. A CDN, load balancer or second virtual host answers with an old certificate.
Wrong system clock. If only one device shows the error, check its date and time.

Step 3: Renew and install the certificate

The fix depends on where the certificate comes from.

Let's Encrypt / certbot. Try sudo certbot renew and read the error. Most failures are blocked port 80, a wrong webroot, or DNS challenge credentials. See certbot renewal failed.

Hosting panel (cPanel, FastPanel, Plesk). Reissue or force renewal in the SSL section. If AutoSSL failed, the panel usually logs the reason, often a DNS record pointing elsewhere.

Paid certificate. Generate a new CSR if needed, complete validation, then install the new certificate and chain.

CDN or proxy (Cloudflare and similar). Check both certificates: the edge certificate visitors see and the origin certificate between the CDN and your server. Either can expire.

Step 4: Reload the web server

A very common trap: the certificate file was renewed on disk, but the server still serves the old one from memory. Reload it:

sudo systemctl reload nginx    # or apache2 / httpd

Then verify with the openssl command above, not only in your own browser, which may cache the old state.

Step 5: Find out why it expired

Fixing the symptom is half the job. Common root causes:

Auto-renewal never worked after a server migration.
The cron job or timer was removed.
The domain's DNS changed, so validation fails.
A paid certificate was bought once and nobody tracked the date.
The certificate belongs to a subdomain no one remembered.

Write the cause down. If you do not know why it expired, it will expire again.

Prevention: make expiry visible

Monitor from outside. Check the certificate the way a visitor sees it, by connecting to the live domain. Server-side checks miss problems on CDNs and load balancers.

Alert early and widely. Alert at 30, 14 and 7 days. Send alerts to a shared inbox or channel, not to one developer.

Track every certificate. That includes staging sites, client subdomains and mail servers. Expired certificates on mail or API endpoints break things quietly.

Do not rely on provider emails. Let's Encrypt stopped sending expiration reminder emails in 2025, so a missed renewal now produces no warning at all unless you monitor it yourself.

Plan for shorter lifetimes. The CA/Browser Forum has approved a schedule that shortens the maximum certificate validity, first to 200 days (from March 2026), then 100 days (2027) and 47 days (2029). Manual renewal will stop being practical. Automate issuance, and monitor to confirm the automation works.

Quick checklist

[ ] Confirm expiry date with openssl
[ ] Rule out hostname, chain and CDN issues
[ ] Renew and install the certificate
[ ] Reload the web server
[ ] Verify from outside your network
[ ] Add monitoring and alerts for this domain
[ ] Record the root cause

Browser warning about an expired security certificate on a laptop

After the ssl certificate expired fix

Renewing the certificate is the middle of the job, not the end. Reload the web server, then check the live certificate from outside the machine. A file on disk with a new date does nothing if nginx is still serving the old chain from memory.

Tell the client what happened in one short note: the certificate expired, it is renewed, and the new expiry date. Skip the essay. They want to know checkout works.

Then write the date down somewhere that is not the server. Hosting panels, Cloudflare, and a box under the desk all issue certificates. If the only record is "certbot is installed", the next failure looks the same as this one.

Set a reminder at 14 days, not at 1 day. A failed HTTP-01 challenge on a Friday afternoon is a Monday outage if you only look the day before expiry. The self-hosted monitoring guide is the backup when the renewal job is silent.

If the warning was NET::ERR_CERT_DATE_INVALID, confirm the clock on the server as well. A wrong system time produces the same browser page as a genuinely expired certificate, and renewing will not clear it.

Field notes after an ssl certificate expired fix

Write down which hostname the browser complained about. www and the apex are often different certificates. Renewing one and reloading nginx while the other is still expired looks like "we fixed it" until the client tries the other URL.

Check the chain, not only the leaf date. A new leaf signed by an expired intermediate still warns. openssl s_client shows the dates the browser will use.

If the site sits behind Cloudflare or another proxy, the certificate visitors see may not be the one on your origin. Renew the one in front. An origin certificate can be valid while the edge certificate is the one that expired.

After the fix, click the padlock yourself on a phone that is not on the office network. Cached errors and internal DNS make the office look healthy.

Then put the new date in the tracker before you close the ticket. The outage you just fixed is the one that will repeat if the only record is a Slack thread.

If the renewed certificate still warns, compare the serial number in the browser with the serial on disk. They differ when the wrong virtual host answered, or when a CDN cached the old handshake. Flush that cache, then retest from a network outside the office before you tell the client the ssl certificate expired fix is done.

FAQ

How long does it take to fix an expired certificate?

With working Let's Encrypt or panel automation, minutes. With a paid certificate that needs validation, from minutes to a day or more.

Does an expired certificate hurt SEO?

Visitors are blocked by a warning page, and crawlers may fail to fetch pages during the outage. A short outage rarely causes lasting ranking damage, but conversions suffer immediately.