Running a site
Your SSL certificate expired. What breaks, and how to fix it.
11 July 2026 · 5 min read
On this page
An expired certificate is the closest thing to being offline without actually being offline. The site is running perfectly; browsers simply refuse to show it.
What visitors see
A full-page warning — "Your connection is not private", "NET::ERR_CERT_DATE_INVALID" — with a scary red icon and a button to go back. Continuing requires clicking through an "Advanced" link that is deliberately awkward.
Almost nobody continues. For practical purposes, your site is down.
Worse, it damages trust in a way an outage does not. An outage is bad luck. A security warning suggests something is wrong with you.
Fix it now
If you use Let's Encrypt via your host — which is most people — the certificate is meant to renew automatically every 90 days. When it fails, the fix is usually:
- Log into your hosting control panel
- Find the SSL section — often "SSL/TLS Status" or "Let's Encrypt"
- Click renew or reissue
- Wait a few minutes and reload the site in a private window
If the panel shows an error, the usual causes are below.
If your host manages SSL for you, raise a ticket now and say the certificate has expired and the site is showing a browser warning. That phrasing gets faster handling than "SSL problem".
If you bought a paid certificate, you need to renew with the issuer and reinstall it. Slower, which is one of several reasons paid certificates are rarely worth it for a normal site.
Why auto-renewal fails
DNS changed. Let's Encrypt verifies you control the domain. If you moved nameservers or changed hosts and the old validation is broken, renewal fails silently for 90 days until expiry.
A redirect got in the way. Validation uses a file at /.well-known/acme-challenge/. A redirect rule, a security plugin, or a firewall blocking that path breaks it.
A subdomain was removed that the certificate still covers.
CAA records on your domain do not permit the issuing authority.
The host's automation broke and nobody noticed. More common than you would hope.
Preventing it
Monitor the expiry date. Most uptime monitors include SSL expiry checks — turn it on and set the alert to 14 days. This costs nothing and turns an emergency into a task.
Check it after any DNS or host change. Migrations break renewals routinely, and the breakage is invisible until the certificate lapses months later. It is on the migration checklist for that reason.
Do not stack multiple SSL sources. A certificate at your host, another at Cloudflare, and a plugin forcing HTTPS is a configuration where nobody knows which one is failing.
Related things that look like SSL problems
Mixed content. The certificate is fine, but the page loads some assets over HTTP, so the browser shows "not fully secure" rather than a padlock. Fix by search-and-replacing the old HTTP URLs in the database.
Wrong domain on the certificate. Covers example.com but not www.example.com, so one version works and the other warns. Reissue covering both.
Certificate valid but the site still warns — often a caching layer or CDN serving an old certificate. Purge it.
While you are there
If an expired certificate caught you by surprise, two other things expire quietly and cause the same kind of sudden outage:
Your domain. Check auto-renew is on and the card on file is current. A lapsed domain is considerably worse than a lapsed certificate.
Premium plugin licences. They do not take the site down, but they stop updates, which quietly moves you onto the abandoned software problem.
All three are on the maintenance checklist as annual items — they are the category of failure that gives no warning and needs none, because the dates are known in advance.