How to Fix an Expired SSL Certificate (Step-by-Step Guide)

Visitors are seeing 'Your connection is not private' and traffic is dropping. Here's the fastest path to a fixed, renewed certificate — and how to make sure it never expires unnoticed again.

📅 Published July 2026· ⏳ 9 min read· ✍️ ToolsNovaHub Editorial Team
An expired SSL certificate is one of the most disruptive, entirely preventable outages a website can have — browsers block access outright, search engines may flag the site, and every visitor sees a scary warning screen. The good news: it's almost always fixable within minutes once you know where to look.
📑 Table of Contents

Step 1: Confirm It's Actually Expired

Before touching any configuration, verify the actual expiry date rather than trusting the browser error message alone — sometimes the real issue is a misconfigured intermediate certificate, not expiry. Run your domain through our SSL Certificate Checker to see the exact Not After date and days remaining pulled from Certificate Transparency logs.

If "Days Remaining" shows a negative number, the certificate is confirmed expired. If it shows positive days but browsers still complain, the issue is likely a different one — wrong certificate installed, missing intermediate chain, or hostname mismatch.

Why Certificates Expire Unexpectedly

  • Automated renewal silently failed. Certbot or ACME clients depend on a cron job or systemd timer actually running — server reboots, permission changes, or DNS provider API changes can break it quietly for months.
  • Manual renewal was forgotten. Commercial certificates (1-year validity) require someone to remember and act — no built-in reminder unless you set one up separately.
  • DNS-01 challenge failing. If your renewal method validates via DNS TXT record and your DNS provider's API credentials expired or changed, renewal fails silently.
  • Load balancer / CDN certificate mismatch. The certificate might have renewed on the origin server but never propagated to a CDN edge or load balancer sitting in front of it.

Step-by-Step Fix

1

Identify Your Issuer

Check the expired certificate's issuer (visible in browser certificate details or via our checker) — Let's Encrypt, ZeroSSL, or a commercial CA. The renewal path differs for each.

2

Let's Encrypt / Certbot: Force Renewal

SSH into the server and run certbot renew --force-renewal, then check the certbot logs for the actual failure reason if it errors again.

3

Commercial CA: Reissue via Dashboard

Log into your CA's control panel, generate a new CSR if required, complete domain validation again, and download the reissued certificate bundle.

4

Install the New Certificate

Upload the new certificate and full chain to your web server (Nginx, Apache) or your CDN/load balancer's SSL settings, then restart or reload the web server process.

5

Verify From Multiple Vantage Points

Re-check with our SSL Certificate Checker, and load the site in an incognito browser window (to bypass any local cert caching) to confirm the fix took effect everywhere.

Preventing Future Expiry

⏰
Verify the Renewal Cron Actually Runs
Don't just assume Certbot's installer set up the timer correctly — manually check systemctl status certbot.timer or your crontab.
🔔
Set Up Expiry Monitoring
Use an uptime/monitoring service that specifically alerts on certificate expiry, separate from general uptime checks — a site can be "up" over HTTP while HTTPS is broken.
📋
Calendar Reminder for Manual Certs
If using a commercial CA without auto-renewal, set a calendar reminder 30 days before expiry, not the week of.
🔄
Test Renewal in Dry-Run Mode
Certbot supports certbot renew --dry-run — run this periodically to catch a broken renewal path before it actually matters.

Common Mistakes

People often renew the certificate but forget to reload the web server process, meaning it keeps serving the old expired certificate from memory. Others renew on the origin server but forget a CDN or load balancer in front has its own separate certificate slot that also needs updating. Always verify from an external, cache-free vantage point after any fix.

FAQs

Most likely an automated renewal (like Certbot) silently failed — often due to a broken cron job, changed DNS API credentials, or a permission issue — and no separate expiry monitoring was in place to catch it.
If you use Let's Encrypt/Certbot, often within minutes via a forced renewal command. Commercial CA reissuance can take longer if domain re-validation is required.
HTTPS access will be blocked by browsers until fixed, but the fix itself (renewal + reload) typically takes just a few minutes once you've diagnosed the cause.
For Let's Encrypt/ACME, no — renewal is automatic and doesn't need a new CSR. For most commercial CAs, you can often reuse the same CSR unless your key was rotated or details changed.
Use our free SSL Certificate Checker, which reads live Certificate Transparency log data and shows the exact Not After date and days remaining.
Indirectly, yes — Google may deprioritize a site that's inaccessible or flagged insecure, and organic traffic will drop sharply regardless since most visitors won't click through browser warnings.
Expired means the validity period has passed. Not trusted usually means a chain issue, self-signed certificate, or the issuing CA isn't in the browser's trust store — a different problem requiring a different fix.
Often a CDN or load balancer in front of your origin server has its own separate, outdated certificate that never got updated even though the origin's did.
You generally can't choose — most CAs now cap validity at 90–398 days by industry policy. Shorter lifespans (like Let's Encrypt's 90 days) actually reduce risk exposure if a key is ever compromised.
Yes, and you should — Certbot renews automatically around 30 days before expiry by default, well ahead of the deadline, rather than waiting until the last moment.
Visitors are blocked by a full-page browser warning by default, most will leave rather than click through, and any API integrations or automated services calling your site over HTTPS will likely fail outright.
Yes — most uptime monitoring services (UptimeRobot, Pingdom, and others) offer a dedicated SSL expiry check separate from basic HTTP uptime monitoring.
Yes, wildcard certificates follow the same validity period rules as standard certificates and require the same renewal diligence, just covering more hostnames at once.
Absolutely. Let's Encrypt certificates are production-grade and used by a large share of the web — the main requirement is reliable automated renewal, which is well worth setting up properly once.
Not necessarily — the CA usually isn't at fault. The root cause is almost always a broken renewal process on your side, which switching providers won't fix unless you also fix the automation.
✓ Reviewed by: ToolsNovaHub Editorial Team📅 Last updated: July 2026📜 Sourced from: official RFC / vendor documentation

ToolsNovaHub tools are built and independently maintained with a focus on accurate, no-signup network and security utilities. Spotted an error? Let us know.

🎓
Expert Tip
A single scan from How to Fix an Expired SSL Certificate (Step-by-Step Guide) is a snapshot — security posture drifts as certificates near expiry or headers get overwritten by a new deploy, so schedule periodic re-checks.
⭐
ToolsNovaHub Pro Tip
Combine How to Fix an Expired SSL Certificate (Step-by-Step Guide) with our Website Security Scanner for one combined view covering TLS, headers, and email authentication together.
⚠️
Common Beginner Mistake
Assuming a perfect score from How to Fix an Expired SSL Certificate (Step-by-Step Guide) means the site is fully secure. It checks configuration, not application-layer bugs like SQL injection — pair it with a manual code review.

📋 Related Tools & Guides Comparison

ResourceTypeLink
Blacklist CheckSecurityOpen Tool →
SSL Certificate CheckerSecurityOpen Tool →
Security Headers CheckerSecurityOpen Tool →
Common Website Vulnerabilities Checklist: What to Check & FixGuideRead Guide →
How Content-Security-Policy (CSP) Works: Complete GuideGuideRead Guide →
🔗 Continue exploring: Blacklist Check · SSL Certificate Checker · Security Headers Checker · Common Website Vulnerabilities Checklist: What to Check & Fix · How Content-Security-Policy (CSP) Works: Complete Guide · How to Interpret a Website Security Scan Score
Explore All ToolsNovaHub Tools
🏠 Go to Homepage

🔗 More Guides