SSL certificate expired: what happens and how to fix it
When an SSL certificate expires, browsers block the site with a full-page warning. Here's why certificates expire, how to fix it, and how to prevent it.
What visitors actually see
The moment a certificate expires, browsers stop trusting the connection. Instead of the site, visitors get a full-page security warning — Chrome shows "Your connection is not private" with the error NET::ERR_CERT_DATE_INVALID; Firefox and Safari show equivalents. Most visitors leave at that screen, and on sites that use HSTS, browsers remove the bypass option entirely.
It's not just browsers. API clients, payment webhooks, and integrations that call the site over HTTPS typically fail hard on an expired certificate, so the damage often extends beyond human visitors.
Why certificates expire
Expiration is by design: shorter lifetimes limit the damage of a stolen key and force revalidation of domain ownership. Let's Encrypt certificates last 90 days and are meant to renew automatically about a month before expiry. Commercial certificates last longer but still expire — browser rules have been shortening the maximum lifetime for years, and certificates issued after March 2026 are capped at roughly 200 days.
When a certificate expires in practice, it's usually because automation failed rather than because nobody set it up: a server migration that left the renewal job behind, a DNS change that broke the validation challenge, a firewall blocking the challenge path, or a manual certificate whose renewal reminder went to a former employee's inbox.
How to fix it
The immediate fix is to issue or renew a certificate: through the hosting control panel if the host manages certificates, through the certificate authority for a purchased certificate, or by running the renewal client (for example, certbot renew) on a self-managed server. The web server usually needs a reload afterward to pick up the new certificate.
After renewing, verify that the server sends the full certificate chain, not just the leaf certificate. A missing intermediate certificate produces trust errors on some devices even when the certificate itself is valid — a fix that works in one browser but fails elsewhere is the classic symptom.
How to prevent it happening again
Two layers: automation and monitoring. Auto-renewal with a wide margin (Let's Encrypt clients typically renew at 60 days, leaving 30 days of slack) means a single failed run doesn't cause an outage. Independent expiry monitoring — a check that alerts when a certificate is within a couple of weeks of expiring — catches the cases where automation silently broke. Certificates that can only be renewed manually deserve a calendar reminder well before the date.
Common questions
- Can visitors bypass an expired certificate warning?
- Usually there's an "Advanced" option to proceed anyway, but most visitors won't use it — and on sites served with HSTS, browsers remove the bypass entirely, making the site unreachable until the certificate is renewed.
- How long are SSL certificates valid?
- Let's Encrypt certificates last 90 days. Publicly trusted commercial certificates issued after March 2026 are capped at roughly 200 days, and browser rules are scheduled to shorten that further in the coming years.
- Why did my certificate's auto-renewal fail?
- Common causes: the renewal job was lost in a server migration, a DNS change broke the domain-validation challenge, a firewall or redirect blocks the challenge path, or the renewal succeeded but the web server was never reloaded to use the new certificate.
Certificate validity, expiry countdown, and security headers.
Check your certificate now →