SSL and HTTPS Problems

SSL Certificate Expired

Intermediate Risk: medium

Last reviewed August 7, 2026

Hosting access may not be needed Database access usually not needed

Direct answer

An expired SSL certificate means the validity window on your site’s certificate has passed, so browsers now block or warn visitors instead of trusting the connection. Reissue and reinstall a fresh certificate through your host, Cloudflare, or a manual provider, then confirm auto-renewal is actually working so it does not silently expire again.

Every SSL/TLS certificate has a fixed expiration date — 90 days for Let’s Encrypt, up to about a year for most commercial certificates. When that date passes, every browser flags the site as untrustworthy regardless of how well the rest of the certificate was configured. This guide covers how to confirm expiry, reissue quickly, and fix the renewal automation so the outage does not repeat.

Intermediate

Key facts

Verifiable numbers and definitions — each claim links to its source.

Let's Encrypt certificates are valid for 90 days and are designed to be renewed automatically before expiry. (Let's Encrypt FAQ)
Let's Encrypt recommends renewing certificates when one-third of their lifetime remains (around day 60 for a 90-day cert). (Let's Encrypt integration guide)
TLS uses certificates so browsers can verify the server's identity and encrypt the connection. (MDN Transport Layer Security)

What the error means

A certificate is only valid between its “not before” and “not after” dates, both baked into the certificate itself when it is issued. Browsers check that date on every connection; once “not after” passes, they treat the site exactly as if the certificate were invalid — full-page warnings, blocked navigation, and “not secure” labeling. This is different from a certificate that is misconfigured, mismatched to the domain, or missing intermediate certificates: those are chain or configuration problems, while expiry is purely a clock problem. Automated issuers like Let’s Encrypt use short 90-day lifetimes specifically to force renewal automation — when that automation breaks (a cron job stops running, a plugin loses API access, a host migration drops the renewal hook), the certificate quietly counts down to expiry with no warning until it is too late.

Common symptoms

Browsers show “Your connection is not private” or NET::ERR_CERT_DATE_INVALID
The warning names the exact expiration date, which is in the past
Some visitors on cached connections or with clock skew see the site load briefly before the warning appears
SSL checker tools report the certificate as expired rather than untrusted or mismatched
The site worked fine yesterday or last week with no configuration changes
Mobile apps or API integrations that pin the certificate fail with generic connection errors
The issue affects every page and every browser consistently, not just specific paths

Most likely causes

01 Let’s Encrypt or AutoSSL renewal cron job stopped running or lost required permissions
02 A manually purchased (paid) certificate reached its 1–2 year expiration with no renewal reminder acted on
03 Domain validation for auto-renewal failed silently (DNS record removed, file-based validation path blocked)
04 A hosting migration moved the site without migrating the renewal automation or ACME account
05 Cloudflare proxy or a firewall rule blocking the ACME HTTP-01 or DNS-01 challenge used to prove domain ownership
06 Rate limiting from the certificate authority after repeated failed renewal attempts
07 Server clock drift causing the renewal script to miscalculate when to run

What changed before the problem started

A hosting migration or server rebuild that did not carry over renewal configuration
DNS records changed or moved to a new provider, breaking domain validation
A firewall, security plugin, or CDN rule added that blocks ACME validation requests
A paid certificate’s renewal invoice was missed or the account lapsed
cPanel/Plesk AutoSSL was disabled or a related service was deactivated
Cloudflare SSL/TLS mode or proxy status changed, altering which certificate the browser actually sees

Troubleshooting steps

Troubleshooting flow

Let’s Encrypt or AutoSSL renewal cron job stopped running or lost required permissions

A manually purchased (paid) certificate reached its 1–2 year expiration with no renewal reminder acted on

Domain validation for auto-renewal failed silently (DNS record removed, file-based validation path blocked)

A hosting migration moved the site without migrating the renewal automation or ACME account

01
Confirm the exact expiration date and scope
Click the padlock/warning in the browser or use an SSL checker to see the precise “not after” date and which hostnames are covered. Confirm every affected domain and subdomain — www and the bare domain sometimes carry separate certificates with different expiry dates.
02
Check whether Cloudflare or a CDN is proxying the site
If Cloudflare is active, the visitor may be seeing Cloudflare’s edge certificate (which auto-renews independently) or your origin certificate depending on SSL/TLS mode. Confirm which certificate is actually expired — edge or origin — before reissuing the wrong one.
03
Reissue via your host’s auto-SSL if available
In cPanel, most hosts offer “Run AutoSSL” to force an immediate Let’s Encrypt reissue. In Plesk, use “Renew” under the SSL/TLS Certificates panel. This is usually the fastest path back to a valid certificate for shared hosting.
04
Reissue manually if automation is broken
If AutoSSL fails, generate a new Let’s Encrypt certificate via your host’s SSL tool or `certbot` on a VPS, or reissue a paid certificate through the issuing certificate authority’s portal using your existing CSR or account access.
05
Install the new certificate and verify the full chain
Apply the new certificate through your host’s SSL panel, ensuring the intermediate/chain certificate is included, not just the leaf certificate. Test with an SSL checker afterward — a missing chain certificate causes trust errors even with a valid, unexpired certificate.
06
Force a hard refresh and check from multiple networks
Some browsers and networks cache certificate validation results briefly. Test in a private/incognito window and from a second device or network before declaring the fix complete.

Confirm the exact expiration date and scope

Click the padlock/warning in the browser or use an SSL checker to see the precise “not after” date and which hostnames are covered. Confirm every affected domain and subdomain — www and the bare domain sometimes carry separate certificates with different expiry dates.

Check whether Cloudflare or a CDN is proxying the site

If Cloudflare is active, the visitor may be seeing Cloudflare’s edge certificate (which auto-renews independently) or your origin certificate depending on SSL/TLS mode. Confirm which certificate is actually expired — edge or origin — before reissuing the wrong one.

Reissue via your host’s auto-SSL if available

In cPanel, most hosts offer “Run AutoSSL” to force an immediate Let’s Encrypt reissue. In Plesk, use “Renew” under the SSL/TLS Certificates panel. This is usually the fastest path back to a valid certificate for shared hosting.

Reissue manually if automation is broken

If AutoSSL fails, generate a new Let’s Encrypt certificate via your host’s SSL tool or `certbot` on a VPS, or reissue a paid certificate through the issuing certificate authority’s portal using your existing CSR or account access.

Install the new certificate and verify the full chain

Apply the new certificate through your host’s SSL panel, ensuring the intermediate/chain certificate is included, not just the leaf certificate. Test with an SSL checker afterward — a missing chain certificate causes trust errors even with a valid, unexpired certificate.

Force a hard refresh and check from multiple networks

Some browsers and networks cache certificate validation results briefly. Test in a private/incognito window and from a second device or network before declaring the fix complete.

When to stop troubleshooting

Escalate if you cannot access the hosting SSL panel or DNS records needed for validation, the certificate authority has rate-limited further attempts and the site needs to be back up sooner, renewal automation keeps failing for reasons you cannot identify in logs, or the site handles checkout/login traffic and needs to be secured immediately rather than during a slow DNS propagation window.

Information to collect before requesting help

01 Exact expiration date and which hostnames/subdomains are affected
02 Certificate issuer (Let’s Encrypt, AutoSSL, Cloudflare, or a paid CA)
03 Whether Cloudflare or another CDN proxies the site, and its SSL/TLS mode
04 Hosting control panel type (cPanel, Plesk, custom VPS) and access credentials
05 Any recent migration, DNS change, or firewall/security plugin update
06 Renewal automation logs or error messages, if available
07 Whether the domain’s DNS is still pointed at the expected host

How a professional repairs the problem

We confirm which certificate (edge or origin) is actually expired, reissue and install a valid certificate with the full chain, diagnose and repair the renewal automation that let it lapse, and put independent expiry monitoring in place so a future renewal failure is caught weeks in advance instead of after visitors see a warning.

Frequently asked questions

Why did my SSL certificate expire without warning? +

Most certificate authorities email renewal reminders, but those often go to an inbox no one checks, or automated renewal was expected to handle it silently and failed without alerting anyone. That is why independent expiry monitoring matters even when auto-renewal is set up.

Will an expired certificate delete my website or data? +

No. Expiry only affects the encrypted HTTPS connection and how browsers treat it. Your files, database, and content are untouched — visitors just cannot reach the site securely until a valid certificate is reinstalled.

Can I just click through the browser warning to check the site? +

You can for testing, but real visitors will not — most abandon the page or are blocked entirely, and search engines penalize sites without valid HTTPS. Treat an expired certificate as a live outage, not a cosmetic warning.

How is an expired certificate different from “not secure” or mixed content? +

“Not secure” with mixed content usually means some page resources still load over plain HTTP even though the certificate itself is valid. An expired certificate is a hard trust failure — the certificate’s date has passed and the entire connection is blocked or flagged, not just individual assets.

Why does the site show expired even after I renewed it? +

You may have renewed the wrong certificate (Cloudflare edge vs. origin), the new certificate was not actually installed on the server, or the browser/CDN is showing a cached result. Verify with an SSL checker and test from a private window on another network.

How often do I need to renew going forward? +

Let’s Encrypt and AutoSSL certificates run on 90-day cycles and should auto-renew around day 60. Paid commercial certificates typically run 1–2 years and require manual renewal unless your host automates it. Either way, set an independent reminder or monitor rather than relying on memory alone.

Repair dispatch

Still Need Help Fixing Your Website?

If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.

You will receive a clear explanation of the likely cause.
We will tell you if the issue falls outside our repair scope.
No additional work will be performed without approval.
A backup should be created whenever access and website condition allow it.

Emergency repair Request diagnosis

Do not share passwords through an unencrypted contact form — use Password Pusher (self-destructing link). Prefer a dedicated Rescue 404 admin account, not your personal owner login; if you cannot create one yet, we will add ours after repair.