SSL certificate expired? What it means and how to fix it

An SSL certificate (strictly, a TLS certificate) proves to visitors' browsers that they are talking to your website. Every certificate has a fixed expiry date. The moment it passes, browsers stop trusting the site, and the effects are immediate:

• Visitors see a full-page warning instead of your site. Chrome and Edge show "Your connection is not private" with the error code NET::ERR_CERT_DATE_INVALID. Firefox shows "Warning: Potential Security Risk Ahead" with SEC_ERROR_EXPIRED_CERTIFICATE. Safari says "This Connection Is Not Private".
• Some visitors cannot get past the warning at all. If your site uses HSTS (HTTP Strict Transport Security), browsers that have visited before will not offer a way to continue.
• Apps and integrations break. Mobile apps, API clients, webhooks and payment callbacks refuse to connect to a server with an expired certificate.
• Search engines cannot crawl your HTTPS pages until the certificate is renewed.

Nothing on the server itself has broken, which is the good news: as soon as a valid certificate is installed, everything works again.

Check the certificate the site is actually serving, from outside your own network. Our free SSL checker shows the expiry date, the days left, the issuer, whether the chain is trusted and whether the certificate covers the name you typed.

If the checker shows a valid certificate but a visitor still sees a warning, look at their device instead: a wrong date or time setting on a computer or phone makes perfectly good certificates look expired. If the checker shows an expired certificate but your hosting panel says it was renewed, the server is still serving the old one: see the causes below.

To check from a terminal on Linux or a Mac:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

The notAfter line is the expiry date. Our guide on how to check an SSL certificate's expiry date covers Windows, browsers and more.

Most certificates today renew automatically, so an expired one almost always means the automation failed quietly. The usual causes:

The renewal job stopped running

Certbot and other ACME clients run from a cron job or a systemd timer. A server rebuild, a package upgrade or a migration to a new machine can leave the timer missing or disabled, and nothing complains until the certificate runs out.

The domain validation step failed

To renew, the certificate authority checks that you still control the domain, usually by fetching a file over HTTP or reading a DNS record. A new redirect, a firewall rule, a CDN setting or a change of DNS provider can make that check fail, and every renewal attempt fails with it.

The certificate renewed, but the server never loaded it

Web servers read certificates when they start or reload. If the renewal hook does not reload Nginx, Apache or your load balancer, the new certificate sits on disk while the old one keeps being served until it expires.

A different server answers for the domain

Load balancers, CDNs and old servers that still receive some traffic each hold their own copy of the certificate. Renewing it on one machine does nothing for the others.

Payment or account problems

Paid certificates and hosting plans that bundle them can lapse because a card expired or renewal emails went to someone who has left.

Certificates expire more often than they used to

Since 15 March 2026, publicly trusted certificates can be valid for at most 200 days, and the limit falls to 100 days in March 2027 and 47 days in March 2029. More renewals mean more chances for one of the failures above. Read more in our guide to the SSL certificate expiry changes.

On your own server with Certbot

1. See which certificates exist and when they expire: sudo certbot certificates
2. Renew them: sudo certbot renew. If it fails, the error usually names the validation problem, such as a blocked HTTP challenge or a DNS record that has changed.
3. Reload the web server so it picks up the new certificate, for example sudo systemctl reload nginx or sudo systemctl reload apache2.
4. Confirm the renewal timer is active, for example with systemctl list-timers, and test the next run with sudo certbot renew --dry-run.

On shared hosting, cPanel or Plesk

Open the SSL/TLS section of the control panel and reissue or renew the certificate there. Most panels include a free automated certificate (AutoSSL in cPanel, Let's Encrypt in Plesk). If the reissue fails, check that the domain's DNS points at the hosting server, because validation depends on it.

Behind a CDN such as Cloudflare

There are two certificates to think about: the one the CDN shows to visitors, which it usually renews for you, and the one on your origin server that the CDN connects to. An expired origin certificate shows up as an error page from the CDN rather than a browser warning, so renew the certificate on the origin as well.

For a paid certificate

Renew through the certificate authority or reseller, complete validation, then install the new certificate and its intermediate certificates on every server or load balancer that serves the domain.

Finally, run the SSL checker again to confirm the new expiry date and a trusted chain.

• Test renewals before they are due. A dry run each month catches broken validation weeks before the real expiry.
• Reload after every renewal. Add a deploy hook that reloads the web server, and confirm the served certificate changes.
• Keep an inventory. List every hostname that serves HTTPS, including API subdomains, staging sites and old domains that still get traffic.
• Monitor the certificate visitors actually see. An external check catches every failure above, whatever caused it.

PulseStack™ SSL certificate monitoring checks your certificates up to once an hour and alerts you when one is within a set number of days of expiry (7 by default), and straight away if it stops being trusted. SSL monitors are included from the Starter plan at £9 a month.

What happens when an SSL certificate expires?

Browsers stop trusting the site straight away and show a full-page security warning instead of it, apps and API clients refuse to connect, and search engine crawlers cannot fetch your pages over HTTPS. Nothing else about the site changes: it works normally again as soon as a renewed certificate is installed.

Is it safe to visit a site with an expired certificate?

The connection may still be encrypted, but your browser can no longer confirm who is on the other end, so you should not enter passwords or payment details. If it is your own site, fix the certificate rather than asking visitors to click past the warning.

How long does it take to fix an expired SSL certificate?

Often a few minutes. Renewing with an automated authority such as Let's Encrypt, or through your host's control panel, is usually quick. Paid certificates that need organisation validation can take longer, which is why renewing well before the expiry date matters.

Why does my site work on one device but not another?

If the certificate has really expired, every up-to-date device will warn. If only some devices warn, check the date and time on those devices, or whether the server is missing an intermediate certificate that some browsers can fetch for themselves and others cannot.

Can an expired SSL certificate hurt SEO?

A certificate that expires for a few hours rarely has a lasting effect, but while it is expired crawlers cannot fetch your HTTPS pages, and a long or repeated lapse can lead to pages dropping from search results. Visitors who see the warning also tend to leave.

How do I stop it happening again?

Check that automatic renewal is really running, reload the web server after each renewal, and monitor the certificate your site actually serves, so you get an alert well before the expiry date and straight away if a renewal fails.