SSL Certificate Expired? How to Fix It

An SSL/TLS certificate has two jobs: it encrypts traffic between a server and a visitor's browser, and it proves the server is who it claims to be. Every certificate carries an expiration date, and once that date passes, browsers stop trusting it, no matter how well-configured the rest of the site is.

Check a certificate now See any site's expiration date, issuer, and days remaining on HostChecker.

What happens the moment it expires

There's no grace period. The instant a certificate passes its expiration timestamp, browsers like Chrome, Firefox, and Safari flag the connection as untrusted and show a full-page warning ("Your connection is not private" or similar) before the page loads. Many visitors close the tab rather than click through it, and anything that cannot click through, such as an app, an API client, or a script, simply fails.

Why certificates expire in the first place

Certificate lifetimes are capped for security reasons: a shorter validity window limits how long a compromised or misissued certificate can be abused before it's forced to renew. Let's Encrypt's default certificate is valid for 90 days today, dropping to 64 days on 10 February 2027 and 45 days on 16 February 2028. For every public certificate authority the maximum is now 200 days (it was 398 days until March 2026), falling to 100 days in March 2027 and 47 days in March 2029. Either way, renewal is not optional, and a very common cause of an expired certificate isn't a technical failure. It's a renewal step that depended on a person remembering to run it.

How to renew, by hosting setup

• Shared hosting (cPanel, Plesk): most control panels auto-renew certificates issued through the host. If yours didn't, the SSL/TLS section of the panel usually has a manual "reissue" or "run AutoSSL" option.
• Let's Encrypt on your own server: renewal is a command, typically certbot renew, meant to run automatically via cron or systemd timer. If it expired anyway, check whether the scheduled job is installed and whether previous runs failed silently.
• Commercial CA (DigiCert, Sectigo, etc.): you'll usually need to generate a new CSR, complete domain validation again, and install the reissued certificate on your server or load balancer.
• Behind Cloudflare or a similar CDN: check both ends. The edge certificate and the origin certificate expire independently, and a warning can come from either side.

Making sure it doesn't happen again

The reliable fix is to remove the manual step. If you're on Let's Encrypt, confirm the auto-renewal job is installed and firing, not just configured, by checking its logs after the fact rather than assuming it ran. If you're on a commercial certificate with a longer lifetime, put the renewal date somewhere with an alert attached, not just a calendar entry that's easy to dismiss. Either way, a periodic check that reports days-until-expiry catches a stalled renewal before it becomes an outage instead of after.

The takeaway

An expired certificate usually means a renewal was missed, and nothing else on the site is wrong. The fix is quick once you know which side (origin, CDN, or CA) needs the new certificate, and the real defense is catching it days before expiry rather than minutes after. HostChecker's SSL check shows issuer, expiration date, and days remaining for any host, so you can confirm a fix or catch a stalled renewal before it expires.