SSL certificate expired: what to do now and how to prevent it
The browser shows your customers a warning instead of your site because the SSL (strictly, TLS) certificate has expired. The fix usually takes a few minutes. What matters more is finding out why automatic renewal failed, because certificates will be valid for shorter and shorter periods.
What customers see
Chrome shows the message "Your connection is not private" with the code NET::ERR_CERT_DATE_INVALID, and Firefox and Safari show similar warnings. Most visitors leave at this point. If the site has HSTS enabled, a browser that already knows it will not even let the visitor bypass the warning. Integrations that connect to your server stop working too: payments, APIs, mobile apps.
What to do now
- Find out who issues the certificate: your hosting (client panel), Cloudflare or another CDN, or your own server with Let's Encrypt. Run the free audit: we will show the issuer and the expiry date. The browser also shows the certificate details when you click the icon to the left of the address.
- On hosting, renew or re-enable the free certificate in the panel. With a paid certificate, order the renewal from the seller.
- On your own server with Let's Encrypt, run the renewal (for example
certbot renew) and reload the web server. If renewal fails, the error message usually points to a cause from the list below. - After renewal, check the site in a private window and make sure the server sends the full certificate chain, not only the domain certificate.
Why automatic renewal failed
- A DNS change or moving the site behind a CDN. Domain validation reaches a different server than the one trying to renew the certificate.
- Port 80 is closed, a redirect points to another server, or a firewall or WAF rule blocks the /.well-known/acme-challenge/ path. The HTTP-01 validation used by Let's Encrypt works only over port 80.
- The renewal job does not run: a disabled timer, a cron entry lost after a system update, an expired DNS API key.
- The certificate was renewed, but the web server was not reloaded and still uses the old one.
- A different server, the same domain: mail, a panel or a subdomain has its own certificate that nobody remembered.
Certificates will be valid for shorter periods
The CA/Browser Forum, the organization of certificate authorities and browser makers, is shortening the maximum validity of public certificates: those issued from March 15, 2026 are valid for at most 200 days, from March 15, 2027 for 100 days, and from March 15, 2029 for 47 days. Renewing by hand once a year stops being possible, so renewal has to run on its own, and someone or something has to watch the expiry date. Since June 4, 2025 Let's Encrypt no longer sends expiry reminder emails.
The free audit checks the expiry date of the certificates on your website and mail server. Run it again after every renewal or hosting change.