SSL Certificate Expired? How to Renew & Fix It Fast

Your site loaded fine yesterday. Today, visitors hit a full-screen red warning instead of your homepage, and traffic just fell off a cliff. If your SSL certificate expired, that alarming page — "Your connection is not private" in Chrome, a slashed padlock in Safari — is what everyone now sees. Take a breath. This is one of the fastest hosting problems to fix, and most sites are back on https within minutes. Below is every cause and the exact steps to renew the certificate yourself, right now.

Quick Answer: An expired SSL certificate means the certificate that secures your site over https has passed its validity date, so browsers block the page with a security warning. To fix it, renew the certificate — run sudo certbot renew for Let's Encrypt, re-run AutoSSL in cPanel, or install a fresh certificate from your provider — then reload your web server. Most sites are back within 5 to 10 minutes.

SSL problems account for roughly 20% of the support tickets our team clears every month — part of the 20 to 30 client issues we resolve a day — so we see this exact error constantly. On a fully managed stack like Hostaccent's, renewal runs automatically and you'd never meet this screen. But if certificates are your responsibility right now, this guide is the same checklist our engineers use. Run it top to bottom and you'll be fine.

What an Expired SSL Certificate Actually Means

Every SSL/TLS certificate ships with a fixed lifespan. When that window closes, browsers stop trusting it — even though nothing on your server actually broke. Your files, database, and content are all untouched. The certificate simply aged out.

An expired certificate is a trust problem, not a hacking problem. The padlock vanishes because the browser can no longer confirm the certificate is current, so it throws up a warning to protect the visitor from a connection it can't verify.

Here's the part that catches people off guard: the site is technically still running. If you loaded it over plain http (which you shouldn't for anything real), the server would answer. The block happens inside the browser, comparing today's date against the certificate's "Not After" field. Once that date passes, the certificate is invalid everywhere, all at once.

That's also why it feels like the whole world went dark in the same minute. There's no gradual rollout. One second the certificate is valid; the next, every visitor on every device sees the same wall. If you want the deeper mechanics, Mozilla's reference on how HTTPS and TLS actually work is the clearest explanation of what the browser is checking.

Why Your SSL Certificate Expired: Causes Ranked by Frequency

Most expired-certificate cases trace back to five causes. In the tickets we handle, they turn up in roughly this order.

1. Automatic renewal quietly failed. Let's Encrypt certificates last just 90 days and are built to renew on their own. When the renewal job breaks — a failed validation, a stopped timer, port 80 blocked — nobody notices until the day it lapses.
2. A paid certificate reached the end of its term. Commercial certificates historically ran about 398 days. Someone missed the renewal reminder in their inbox, and it expired.
3. cPanel AutoSSL didn't run. The domain failed a validation check (often a stray DNS or CAA record), or AutoSSL was switched off for that account.
4. Cloudflare's origin certificate expired. The edge still looks healthy, but the certificate on your actual server lapsed, breaking the link between Cloudflare and origin.
5. Your device clock is wrong. Uncommon, but real. If only you see the error while every other device loads fine, your computer's date is off — the certificate isn't actually expired.

Pro Tip: Before you touch a single server setting, open the site on your phone using mobile data (not your Wi-Fi). If the phone loads it perfectly, the certificate is valid and your computer's clock is the culprit. Check your system date before you burn an hour "fixing" a server that was never broken.

How to Renew an Expired SSL Certificate — Step by Step

Find your setup below and follow that path. The certificate expired, and the fix is almost always the same shape: reissue or reinstall the certificate, then reload the web server. Only the details change by platform.

If you use Let's Encrypt with Certbot

This is the most common setup on a self-managed VPS. First, test what a renewal would do without committing:

bashCopy
sudo certbot renew --dry-run

If the dry run succeeds, renew for real and reload your web server so it picks up the new certificate:

bashCopy
sudo certbot renew
sudo systemctl reload nginx    ## use apache2 if you run Apache

If Certbot insists the certificate isn't due yet but it's clearly expired, force it:

bashCopy
sudo certbot renew --force-renewal

Renewal failing on validation is its own rabbit hole — usually port 80 closed or a webroot mismatch that stops the HTTP challenge. We wrote a full walkthrough for exactly that failure: Certbot Renewal Failed? Fix Let's Encrypt SSL (2026). For the edge cases, Let's Encrypt's own renewal documentation is worth a bookmark.

If you're on cPanel with AutoSSL

Most shared hosting runs AutoSSL, which should reissue free certificates automatically. To force it through by hand:

• In cPanel, open SSL/TLS Status, tick your domains, and click Run AutoSSL.
• With WHM access, go to SSL/TLS → Manage AutoSSL → Manage Users and run it for the account.

When AutoSSL keeps skipping one domain, the reason is almost always a failed domain-control check — a CAA record blocking the issuing authority, or the domain resolving somewhere else. Fix the DNS first, then re-run. Don't keep hammering the button; it won't succeed until validation passes.

If you have a paid (commercial) certificate

You'll reissue it through whoever sold it to you, then install the new files:

1. Generate a fresh CSR (or reuse the existing private key) and submit it to the certificate authority.
2. Complete domain validation — email approval or a DNS record, depending on the CA.
3. In cPanel, open SSL/TLS → Manage SSL Sites, paste the new certificate, private key, and CA bundle, and install.

If Cloudflare sits in front of your site

A green padlock at the edge can hide an expired certificate on the origin. If you run Full (strict) mode — and you should — the origin certificate has to be valid. Reissue the origin certificate (a Cloudflare Origin CA cert can last up to 15 years) or renew your Let's Encrypt cert as above, then re-check. A related handshake failure is covered here: Cloudflare Error 525: How to Fix SSL Handshake Failed. Cloudflare's SSL learning center explains the edge-to-origin chain if you're new to it.

On our own stack, Cloudflare fronts Nginx and Apache, and every origin certificate renews through automation — which is why Hostaccent clients almost never see this class of ticket in the first place.

Live site and no time to experiment? Our engineers fix this exact error for a small one-time fee, and you'll see the precise quote before anyone touches your server. Already hosted with Hostaccent? Then a lapsed certificate is simply covered by support — no charge. Have an engineer fix it.

Confirm the Fix and Stop It Coming Back

Once you've renewed, verify it properly instead of trusting a browser refresh — cached certificates lie for a few minutes. From any terminal:

bashCopy
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com | openssl x509 -noout -dates

Check the notAfter date; it should now sit comfortably in the future. Prefer a GUI? Click the padlock, open the certificate details, and read the validity dates there. Then hard-refresh with Ctrl+Shift+R to clear the cached warning your own browser is still holding.

Now prevent the repeat — because this is about to matter far more than it used to. The single best defence is automated renewal that you actually monitor. Certificate lifetimes are shrinking on a set schedule: as of March 2026 the maximum lifespan dropped to 200 days, it falls to 100 days in 2027, and to just 47 days by 2029. Miss one 47-day window and you're staring at this page again. Manual renewal is quietly becoming impossible.

So lock in three habits:

• Confirm your auto-renewal actually works. For Certbot, systemctl list-timers | grep certbot should show an active timer, and sudo certbot renew --dry-run run monthly proves it end to end.
• Add an expiry monitor. A free SSL monitor that emails you 14 days before expiry costs nothing and turns a full outage into a calm heads-up.
• Keep port 80 open for validation. Let's Encrypt's HTTP challenge needs it, and blocking it is the number-one reason "automatic" renewals silently fail.

Insider Insight: The 47-day certificate era kills "set it and forget it." On the tickets we handle, the sites that never go dark aren't the ones with the priciest certificates — they're the ones running a working renewal job plus a monitor as backup. Two layers, because automation occasionally fails, and you want to hear about it before your visitors do.

If your site is throwing other errors after the SSL fix — a 403 Forbidden Error: How to Fix It (Step-by-Step 2026) or a How to Fix 404 Not Found Error: Every Cause (2026) — those are usually unrelated and deserve a separate look. Google's why HTTPS matters guidance is a good reminder of why you don't want to leave any of this broken for long.

Your Next Step: A Site Where SSL Never Expires On You

Now that you know the fix is really just "renew and reload" — and that certificate windows are collapsing toward 47 days — you have a choice about how you spend your future afternoons.

If you fixed it yourself: nice work. Set that expiry monitor today, keep port 80 open for validation, and re-run a dry-run monthly. The honest truth, though, is that on a well-run host a lapsed certificate should never reach you at all — it's support's job, not yours. That's the whole idea behind Hostaccent's managed Linux shared hosting with free, self-renewing SSL. The Economy plan — $1.99/mo includes NVMe storage, SSL that renews itself, and daily backups, backed by a 30-day money-back guarantee and 99.9% uptime; we've launched 10,000+ sites and handled 4,000+ migrations since 2012 (UK-incorporated in 2018), so this failure mode is well-worn territory for us. One honest caveat: Economy is sized for a single busy site — running several client projects? The Standard plan at $4.58/mo fits better. Choosing where SSL lives is part of the wider Domain & Hosting Buying Guide: What to Check First.

If you're still stuck: don't lose more hours to it. Open a ticket and our engineers will fix the exact error for a small one-time fee — you'll see the quote first, before any work starts. Seeing "SSL certificate expired" should cost you five minutes, not a lost day.

Frequently Asked Questions About Expired SSL Certificates

What does "SSL certificate expired" actually mean?

It means the certificate that encrypts traffic to your site has passed its validity date, so browsers no longer trust it and show a security warning. Your server and files are untouched — only the certificate needs renewing. Reissue or renew it, reload your web server, and https returns.

How do I renew an SSL certificate that has expired?

For Let's Encrypt, run sudo certbot renew and reload your web server. On cPanel, run AutoSSL from SSL/TLS Status. For a paid certificate, reissue it through your provider and install the new files. Most renewals finish in under 10 minutes once you're on the right path.

Why does my browser say "your connection is not private"?

That warning appears when the browser can't validate your certificate — most often because it expired, though a name mismatch triggers it too. If the site worked yesterday and suddenly broke for everyone, an expired certificate is the likely cause. Renew it, hard-refresh, and the warning clears.

Will an expired certificate hurt my Google rankings?

A day or two of downtime won't tank rankings, but it's risky. Google treats https as a signal, and if crawlers keep hitting the security warning, indexing and trust take a knock. Fix it within hours, not days, and you'll almost certainly recover with no lasting damage.

How long does an SSL certificate last?

Let's Encrypt certificates last 90 days. Commercial certificates historically ran up to 398 days, but new rules are shrinking that fast: 200 days from March 2026, 100 days from 2027, and just 47 days by 2029. Whatever type you use, automated renewal is now essential rather than nice-to-have.

Can I get free SSL that renews automatically?

Yes. Let's Encrypt is free and designed for auto-renewal, and most managed hosts bundle it at no cost. On Hostaccent's plans, for example, SSL is issued and renewed automatically, so an expired certificate simply doesn't reach the site owner. If you'd rather never think about certificates again, that's the setup to look for.