SSL Certificate Expired: How to Check, Renew and Prevent It

An SSL certificate expired warning doesn't just look bad — it actively blocks visitors from reaching your site, tanks your search rankings, and can trigger browser security alerts that are genuinely scary to non-technical users. The good news is that renewing an expired SSL certificate is straightforward once you know the steps, and preventing future expirations is even easier.

What Actually Happens When Your SSL Certificate Expires

When your SSL certificate expires, browsers immediately stop trusting your site. Chrome, Firefox, Safari, and Edge all display a full-page warning that tells visitors "Your connection is not private" or "This site's security certificate has expired." Most users won't click past that warning — and they shouldn't have to.

Beyond the visitor experience, here's what else breaks:

• HTTPS stops working. Browsers show a full-page warning instead of the site, and nothing switches to HTTP on its own.
• SEO takes a hit. Google uses HTTPS as a ranking signal. A broken or expired certificate can cause your pages to drop in search results or be flagged as insecure.
• APIs and integrations break. Any service that makes HTTPS calls to your domain — payment processors, webhooks, mobile apps — will start throwing certificate errors.
• Email delivery can be affected. If your mail server uses TLS with the same certificate, email clients may reject connections.

How to Check SSL Certificate Expiration Date

Before you renew, you need to verify certificate validity and confirm exactly when it expires. There are several ways to do an SSL expiration check.

From Your Browser

1. Visit your site in Chrome or Firefox.
2. Click the padlock icon in the address bar (or the "Not Secure" warning).
3. Select "Connection is secure" then "Certificate is valid."
4. Look for the "Valid until" or "Expires on" date in the certificate details panel.

From the Command Line (OpenSSL)

If you have server access or want to check a domain programmatically, OpenSSL gives you precise details:

echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates

This outputs notBefore and notAfter dates. The notAfter value is your expiration date.

Check the Certificate File Directly

If you have the .crt or .pem file on your server, you can inspect it directly:

openssl x509 -in /path/to/your/certificate.crt -noout -enddate

How to Renew Your SSL Certificate

The renewal process depends on where and how your certificate was issued. Here are the three most common scenarios.

Option 1: Let's Encrypt (Auto-Renewal with Certbot)

Let's Encrypt certificates are free and expire every 90 days by design, but Certbot handles renewal automatically. To renew manually or check renewal status:

# Check renewal status
sudo certbot renew --dry-run

# Force renewal immediately
sudo certbot renew --force-renewal

Let's Encrypt no longer emails expiry warnings, so a silent Certbot failure only shows up when the site breaks; check certbot renew --dry-run after server changes.

If auto-renewal has been failing silently, check your cron job or systemd timer:

sudo systemctl status certbot.timer

Option 2: Renewing Through a Paid CA (DigiCert, Sectigo, etc.)

1. Log in to your CA's dashboard and locate the expiring certificate.
2. Generate a new CSR (Certificate Signing Request) on your server. Most CAs walk you through this, but you can also generate one with OpenSSL:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

3. Submit the CSR to your CA and complete domain validation (DV), organization validation (OV), or extended validation (EV) depending on your certificate type.
4. Download the new certificate files (typically a .crt file plus an intermediate/chain file).
5. Install the new certificate on your server and restart the web server (Apache, Nginx, etc.).

Option 3: Renewing Through a Hosting Control Panel

If your site is on shared hosting (cPanel, Plesk, or a managed platform like WP Engine or Kinsta), the process is usually a few clicks:

• cPanel: Go to SSL/TLS Manager and use the "Manage SSL Sites" section.
• Plesk: Navigate to Domains, select your domain, click SSL/TLS Certificates.
• Managed WordPress hosts: Most handle certificate renewal automatically. Check your dashboard's SSL section if you see a warning.

After Renewal: Verify Certificate Validity

After installing the renewed certificate, always run a quick SSL expiration check to confirm the new certificate is active and correctly chained. Use the OpenSSL command from the previous section, or check your browser's certificate details again.

Common Certificate Errors and What They Mean

Not every certificate error means the cert has expired. Here's a quick breakdown of the most common ones:

The Mozilla Developer Network's documentation on certificate transparency is a solid reference if you're troubleshooting chain or trust errors in more depth.

How to Prevent SSL Expiration in the Future

Expiration is almost always preventable. Here are the most reliable methods:

• Use Let's Encrypt with Certbot auto-renewal. The 90-day cycle sounds short, but Certbot renews automatically 30 days before expiry. Set it up once and forget it (mostly).
• Set calendar reminders. If you buy certificates from a paid CA, put a reminder 45 days before the expiration date. That gives you time to renew without rushing.
• Use your CA's monitoring alerts. Every major CA (DigiCert, Sectigo, GlobalSign) sends email reminders. Make sure those go to an actively monitored inbox.
• Enable external uptime monitoring with SSL checks. Services that monitor your site for downtime often include SSL expiration checks as part of the package. You'll get an alert before the certificate actually expires.
• Document your certificates. Keep a simple spreadsheet or note with domain name, CA, expiration date, and renewal contact. For teams, this prevents the "I thought someone else handled it" situation.

Certificate Management for Multiple Domains

If you manage more than a handful of sites, tracking individual certificate expiration dates manually doesn't scale. Good certificate management at this level usually involves one of these approaches:

• Wildcard certificates: A single wildcard cert (e.g., *.yourdomain.com) covers all subdomains. One renewal instead of many, though it doesn't help if you manage multiple root domains.
• Multi-domain (SAN) certificates: A Subject Alternative Name certificate can cover dozens of different domains under one renewal cycle.
• Centralized monitoring: Tools and scripts that ping each domain's SSL handshake and report back expiration dates in a single dashboard.
• Infrastructure-as-code: If you're managing certificates in cloud environments (AWS Certificate Manager, Google-managed SSL, Cloudflare), certificates are often renewed automatically as part of the platform.

For teams running many domains, the biggest risk isn't forgetting to renew — it's not knowing which certificates exist in the first place. Periodic audits using a script that checks every domain in your inventory against its SSL expiration date are worth the setup time; run it daily as a cron job.

Force HTTPS once the new certificate is live

Renewed the certificate on an Apache server? Use our free .htaccess generator to build the redirect rules by toggling options in your browser, then copy or download the file.

Open the .htaccess Generator →

SSL certificate renewal questions