SSL Certificate Expired? How to Fix It Fast

If you landed here, there's a good chance your site is throwing a scary security warning right now — something like "Your connection is not private" (Chrome), "Warning: Potential Security Risk Ahead" (Firefox), or "This Connection Is Not Private" (Safari). The usual cause is the simplest one: your SSL/TLS certificate has expired. The good news is that this is one of the fastest web emergencies to fix. Here's how to do it, step by step.

First, confirm it's actually expired

Before touching anything, verify that expiry is the real problem — the same browser warning can be caused by a misconfigured certificate, a wrong domain name on the certificate, or an untrusted issuer.

The fastest check is to run the domain through our free domain and SSL expiry checker — it reads the certificate straight from the live connection and shows you the exact expiry date. If the SSL date is in the past, expiry is your culprit.

You can also check directly in the browser: click the padlock (or the "Not secure" warning) in the address bar, open the certificate details, and look at the "Valid to" / "Expires on" date. In a terminal:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates

You'll get a notAfter= line with the expiry timestamp. If it's earlier than today, the certificate has lapsed.

The fix, in four steps

1. Renew the certificate

How you renew depends on where the certificate came from:

• Let's Encrypt (free, 90-day certs): these are meant to auto-renew via certbot. If it expired, the renewal cron/timer probably failed silently. Run sudo certbot renew and watch for errors. To force it: sudo certbot renew --force-renewal.
• A paid certificate authority (DigiCert, Sectigo, etc.): log in to the CA or the reseller you bought it from, renew the certificate (this may require re-issuing with a new CSR), and download the new certificate files.
• A managed host or platform (Vercel, Netlify, Cloudflare, Squarespace, Shopify, cPanel): in most cases the platform issues and renews SSL for you automatically. An expired cert here usually means DNS moved, the domain verification broke, or automatic SSL got toggled off. Open your platform's SSL/TLS settings and re-trigger issuance.

2. Install the new certificate

If your host manages SSL, installation is automatic once renewal succeeds — you're done. If you run your own server, replace the old certificate files (and the intermediate/chain file) with the new ones. On nginx that's your ssl_certificate and ssl_certificate_key paths; on Apache it's SSLCertificateFile and SSLCertificateKeyFile.

3. Restart / reload the web server

A running server holds the old certificate in memory until you reload it. This is the step people forget:

sudo systemctl reload nginx     # or: apache2, httpd

4. Verify from the outside

Don't trust your own cached browser — you may still see the old certificate for a while. Re-run the expiry checker or the openssl command above and confirm the new notAfter date is in the future. Then hard-refresh the site (Cmd/Ctrl+Shift+R) or open it in a private window.

Why the warning may linger after you fix it

If everything looks renewed but visitors still report the error, check these:

• Browser cache / HSTS: browsers cache certificate state aggressively. A hard refresh or private window usually clears it.
• Missing intermediate chain: if you installed only the leaf certificate and not the intermediate bundle, some browsers and many API clients will reject it even though it's valid. Reinstall the full chain.
• Multiple servers or a CDN: if you run several load-balanced servers or a CDN edge, make sure every node got the new certificate, not just one.
• www vs apex: confirm the new certificate covers every hostname you serve (both example.com and www.example.com), or you'll fix one and break the other.

Make sure it never happens again

An expired certificate is almost always an avoidable outage — it didn't break, it simply ran out. The two durable fixes:

1. Automate renewal wherever you can. Let's Encrypt certificates are designed to renew unattended; managed hosts do it for you. If you're renewing certificates by hand once a year, that's the fragile part.
2. Monitor the expiry date independently of the renewal system — because auto-renewal fails silently more often than anyone expects (a broken cron, an expired API token, a DNS change). A monitor that emails you 30 and 7 days out turns "the site is down" into "renew this by Friday."

That second point is exactly what DomainChest does. Add your domain once and it watches the live certificate — and the domain registration alongside it — then emails you well before either expires. For the bigger picture on certificate lapses, read what happens when an SSL certificate expires. And since domain and certificate dates are easy to confuse, it's worth also knowing what happens when a domain expires — a very different, and more permanent, kind of problem.