SSL Certificate Expired: What To Do Right Now (and How to Stop It Happening Again)

An expired SSL certificate does not look dramatic in a monitoring dashboard. It looks dramatic in a browser: red interstitial, NET::ERR_CERT_DATE_INVALID, confused users, and a support queue that starts with “the site is down” even when the web server is fine. TLS failed the trust check; the app may still be answering on port 443.

This guide is the order of operations we use when a production cert dies: restore HTTPS first, then fix the renewal path so you are not back here in ninety days.

Browser warning when an SSL certificate has expired

Confirm It Is Really Expiry

Before you regenerate anything, prove the failure mode.

From a machine that can reach the host:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -subject

Check notAfter. If that timestamp is in the past, you have expiry (or a clock skew story—rare on properly NTP’d servers). Also open the site in a private window and note the exact browser error. “Certificate not trusted” or “incomplete chain” are different problems; see our guide on an incomplete SSL certificate chain.

If the leaf is still valid but the intermediate expired, browsers behave almost the same as leaf expiry. That is why pasting only the leaf into IIS or Apache still breaks trust.

Restore HTTPS in the Next Hour

Pick the shortest path that matches how the cert was issued.

Path A — You still control ACME (Let's Encrypt / AutoSSL)

If HTTP-01 or DNS-01 still works, force a renewal with the same client that issued the last cert. Mixing Certbot, AutoSSL, and a random cron script on one vhost is how teams get two certificates fighting for the same binding.

cPanel: WHM → AutoSSL → Run for the account, then confirm the domain shows a fresh “not after”. Details in cPanel SSL automation.
Plesk: Re-run the Let's Encrypt extension for the domain; watch for wildcard DNS failures. See Plesk SSL automation.
IIS / Windows: Prefer one orchestrated renew-and-bind cycle rather than hand-importing a PFX you generated on a laptop. Background: automating Let's Encrypt on IIS.

Path B — Commercial certificate, files on disk

If you bought DV/OV elsewhere and still have the private key:

Re-issue or renew at the CA (or reseller) for the same CSR/key when possible.
Download leaf + intermediates (full chain), not leaf alone.
Install in the format your stack expects—PEM for Nginx/Apache, PFX often for IIS. Format cheat sheet: PEM vs PFX.
Reload the server (nginx -s reload, systemctl reload httpd, IIS binding refresh).

If the private key is gone, you cannot “revive” the old cert. Issue a new one, complete DCV again, and treat key loss as an incident—not a paperwork inconvenience.

Path C — Appliance or panel you do not live in daily

Firewalls and load balancers often keep serving an old cert long after the CA issued a replacement. Push or import the new material to the device that actually terminates TLS (F5, FortiGate, etc.). FortiGate-oriented notes: FortiGate SSL certificate.

After Traffic Is Green: Find Why Renewal Failed

Expiry is a symptom. Common root causes:

Cause	What you see	Fix direction
HTTP-01 blocked	ACME client timeout / 404 on `/.well-known`	Fix vhost docroot, CDN bypass, or switch to DNS-01
DNS-01 TXT stale	Challenge pending forever	API token permissions; remove orphaned TXT records
AutoSSL skipped domain	Panel log: “local HTTP challenge failed”	Proxy, force HTTPS redirect loops, missing alias
Calendar renewals	Human forgot	Remove humans from the loop
Shorter public lifetimes	More renewals per year	Automation becomes mandatory, not nice-to-have

Public validity is still compressing under CA/Browser Forum timelines—see SSL certificate validity periods and the cost angle in 2027 SSL prices. Four quiet renewals a year beat one loud outage.

A Practical Anti-Expiry Checklist

Inventory every hostname that terminates TLS—including www, API, mail web UI, and staging that customers somehow bookmark.
One owner per cert path—panel AutoSSL or central ACME or commercial automation, not all three.
Alert at 21 / 14 / 7 days, and alert on failed renewal, not only on expiry.
Test restore once: revoke a lab cert or force renew and confirm bind + reload.
Document the private key location (HSM, agent store, panel)—without it, commercial reissue becomes a scramble.

MSPs: keep per-tenant inventories separate but monitor from one place. Spreadsheet expiry columns age poorly; a multi-tenant control plane is the boring alternative.

How Certinite Fits

Certinite is built for the part after “certificate file exists”: schedule renewals, run ACME or commercial issuance, and deploy to Windows agents, Linux targets, and connectors so HTTPS comes back without pasting PEMs at 2 a.m. Free Let's Encrypt automation and paid DV downloads can live in the same operational model—see free SSL vs paid SSL if you are still choosing product type.

If you are mid-incident and only need a commercial DV quickly, use the buy flow, then automate the next cycle: how to buy an SSL certificate.

FAQ

Will renewing the certificate change my SEO rankings?

A short HTTPS outage can drop availability metrics; Google does not “penalize SSL expiry” as a special ranking factor the way people claim on forums. Fix trust quickly, keep 301s intact, and you usually recover. Leaving the site on HTTP or with a permanent cert error is the real problem.

Can I extend an expired certificate without re-validating the domain?

No. Once it is expired (or revoked), you need a new issuance and fresh domain control validation for public trust.

Is Let's Encrypt less reliable because it expires every ~90 days?

The crypto is fine. The operational load is higher. If HTTP-01 or DNS-01 is solid and monitored, free DV is excellent. If renewals are manual, paid annual billing will not save you when lifetimes shrink further.

What if only some users see the expiry warning?

Classic CDN / regional PoP / sticky old certificate on one node of a load balancer. Check the cert from multiple networks and inspect each terminator, not only the origin.

Bottom Line

When an SSL certificate expires, restore a trusted chain on the device that terminates TLS, then eliminate the manual renewal that allowed the date to pass. Shorter public lifetimes make automation the default posture—not a luxury feature.