SSL Certificate Expired: What to Do Today

Yesterday your site worked. Today visitors see a warning page instead of your homepage. When an SSL certificate expires, browsers no longer trust the site, and they say so in large red or grey letters. Here is how to get back online fast.

What visitors see

• Chrome and Edge: "Your connection is not private" with the code NET::ERR_CERT_DATE_INVALID.
• Firefox: "Warning: Potential Security Risk Ahead" with SEC_ERROR_EXPIRED_CERTIFICATE.
• Safari: "This Connection Is Not Private".

Visitors can click through, but very few do. Contact forms and online booking also stop working for most people.

Step 1: Confirm it really expired

Click the icon to the left of the address bar, open the certificate details and look at the "Valid to" or "Expires on" date. You can also run the free SSL Server Test from Qualys SSL Labs, which shows the dates and any other problems.

One trap: if only one person sees the warning, check the date and time on their device. A phone or laptop with the wrong date shows the same error for every site.

Step 2: Renew it the right way for your setup

Free certificate from your host (Let's Encrypt or AutoSSL)

These renew themselves, so an expired one means the renewal failed. Common reasons: the domain now points somewhere else, a firewall or security plugin blocks the check, or the site moved to a new server. Open your control panel's SSL section and run the renewal again ("Run AutoSSL" in cPanel, for example). If it fails, send the error message to your host's support team.

Paid certificate

Log in where you bought it and renew. You will usually need to prove you control the domain (by email, a DNS record or a file on the site). Then install the new certificate on your server together with the intermediate certificates the seller gives you. A missing intermediate causes errors on some phones even when the date is fine.

Website builder (Wix, Squarespace, Shopify and similar)

The builder manages the certificate for you. An expiry usually means the domain's DNS records no longer point to the builder. Check the domain connection page in your builder's settings, fix the records it asks for, and contact support if it still fails.

CDN or proxy (such as Cloudflare)

The certificate visitors see usually renews automatically. If the certificate on your own server expires, you may see an error page from the CDN instead (Cloudflare shows error 526). Renew the server's certificate, or install a long-life origin certificate from the CDN.

Step 3: Check everything after renewal

• Open the site in a private window on a phone and a computer.
• Test both www.yourdomain.com and yourdomain.com. Each name needs to be on the certificate.
• Run the SSL Labs test again and fix any chain or name warnings.
• Send yourself a test message through the contact form.

Step 4: Make sure it never happens again

• Turn on automatic renewal wherever it exists, and check that it actually ran next time.
• Set your own reminder. Let's Encrypt stopped sending expiry warning emails in 2025, so do not rely on one arriving. A free uptime or certificate monitor can email you a few weeks before expiry.
• Write down who manages what: domain registrar, DNS, hosting, certificate. Most long outages happen because nobody remembers where the login is.
• Do not confuse the two renewals. Your domain name and your certificate expire separately. A lapsed domain takes the whole site and your email offline.

When to ask for help

If renewal fails twice, if your host's support cannot explain why, or if the site runs on a server nobody fully understands, a short professional check usually costs less than another day offline.