SSL Certificate Expired: How to Fix It

Server error: certificate has expired

A server error that says certificate has expired means the SSL/TLS certificate served for a hostname has passed its expiration date. Browsers, API clients, monitoring tools, uptime checks, or server logs may show similar wording, including security certificate expired, SSL certificate expired, certificate has expired or is not yet valid, or website certificate expired.

The first step is to check the certificate expiration date and confirm which hostname is affected. Verify the exact domain and subdomain users or clients are reaching, because example.com, www.example.com, api.example.com, and a CDN hostname can each serve different certificates.

After renewal, verify the full certificate chain, hostname coverage, and HTTPS redirect behavior from outside your hosting provider. This confirms visitors and automated clients are receiving the renewed certificate, not an old certificate from a server, CDN, load balancer, or cache.

• Check the affected domain and subdomain.
• Confirm the SSL certificate expiration date.
• Renew or reissue the certificate.
• Install it on the correct server, CDN, hosting provider, or load balancer.
• Verify the full certificate chain.
• Check HTTPS redirects.
• Set up monitoring and expiration alerts.

What does "security certificate expired" mean?

Security certificate expired means the SSL or TLS certificate has passed its notAfter validity date. Certificates have a notBefore date, when they start being valid, and a notAfter date, when browsers should stop trusting them.

After notAfter passes, browsers can no longer trust the certificate for HTTPS. Users may see browser security warnings, and the website may lose trust, traffic, and conversions because visitors cannot tell whether the connection is safe.

This can happen even when automatic renewal exists. Renewal may fail because DNS validation changed, account permissions expired, rate limits were hit, or a server did not reload the renewed certificate.

What visitors see when SSL expires

Visitors usually see a browser warning such as the connection is not private or your connection is not secure. Many users will leave instead of clicking through. Login pages, checkout pages, dashboards, and support portals are especially sensitive because trust matters in those workflows.

Automated clients may show errors such as certificate has expired, TLS validation failed, or a generic network failure. Since the TLS handshake fails before the request reaches the app, normal application logs may not show the full incident.

How to check if a certificate is expired

Check the exact public hostname with the Website Certs SSL checker. Read the valid until date and days remaining field. If days remaining is negative or the status is critical because of expiration, the endpoint is serving an expired certificate.

You can also check certificate details in a browser by opening the site information or certificate viewer from the address bar. For command-line checks, OpenSSL can show the certificate validity dates for the hostname you pass with Server Name Indication.

The OpenSSL output includes notBefore and notAfter. notBefore is the first date when the certificate is valid. notAfter is the expiration date.

openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

• Check the exact hostname users report.
• Review valid until and days remaining.
• Confirm hostname match and chain valid fields.
• Run the HTTPS checker after renewal.
• Use the DNS checker if traffic may be going to the wrong endpoint.

How to fix an expired SSL certificate

First renew or reissue the certificate through the system that owns it. That might be your hosting platform, CDN, certificate authority, ACME client, cloud load balancer, Kubernetes ingress, reverse proxy, or managed DNS provider.

Then deploy the certificate to every place that terminates TLS. A certificate can be renewed successfully but still not appear to users if the CDN or server keeps serving the old file. After deployment, reload or redeploy the service if your stack requires it.

1. Confirm the certificate is expired.
2. Renew or reissue the certificate with your certificate provider.
3. Install the renewed certificate on the server, hosting provider, CDN, or load balancer.
4. Verify the certificate chain.
5. Confirm the certificate covers the correct hostname.
6. Test HTTPS redirects.
7. Clear or wait for browser/CDN cache if needed.
8. Set up SSL monitoring and email alerts to prevent the issue from happening again.

How to prevent SSL certificates from expiring

Prevention starts with automatic renewal where possible, but automation should still be monitored. The public endpoint is what matters. If renewal succeeds but deployment fails, visitors still see the expired certificate.

Monitor expiration dates and send email alerts before expiry. A practical schedule is 30, 14, 7, 3, and 1 day before expiration so teams have multiple chances to renew certificates before expiration.

Also check HTTPS availability, certificate chain health, and hostname coverage. Website Certs is free during beta and can help teams monitor SSL, DNS, HTTPS, security headers, and email DNS checks from one place.

• Use automatic renewal where possible.
• Monitor 30, 14, 7, 3, and 1 day before expiration.
• Send alerts to a shared destination.
• Keep a runbook for certificate ownership and deployment.
• Verify the public endpoint after renewal.

How Website Certs can help

Website Certs gives you a free SSL checker for immediate incident triage and monitoring for important domains. Use the checker to confirm whether the public hostname is still serving an expired certificate, then recheck after renewal to verify the valid until date, hostname coverage, and certificate chain.

For prevention, Website Certs can monitor the domain and send email alerts before SSL expires, so the next renewal can happen before visitors see browser warnings.