How to fix an expired SSL certificate (and stop it happening again)

An expired certificate throws a full-page browser warning and turns visitors away. Here is how to renew it fast and set up auto-renewal so it never lapses again.

What an expired certificate breaks

Every TLS certificate has a fixed validity window. Once it passes the expiry date, browsers stop trusting it and show a full-page security warning - NET::ERR_CERT_DATE_INVALID in Chrome - that most visitors will not click through. To them your site is simply down.

The certificate is still installed; it is just out of date. Fixing it means issuing a fresh one and installing that, not repairing the old file.

Renew it now

The fastest path depends on how the certificate was issued:

If you use a host or CDN with managed TLS (Cloudflare, most modern platforms), the renewal is automatic - a lapse usually means the domain moved or the setting was turned off, so re-check that TLS is enabled for the domain.
If you use Let's Encrypt with certbot, run the renewal and reload the server: certbot renew then reload nginx or apache.
If you bought the certificate from a CA, log in, renew or re-issue it, then install the new certificate and its intermediate chain on the server.
Reload the web server so it serves the new certificate, not the cached old one.

After reloading, load the site in a fresh private window - a stale browser tab can keep showing the old error even after the fix is live.

Send the full chain

A common trap: the new certificate is valid but the server does not send the intermediate certificate that links it to a trusted root. Desktop browsers often paper over this, but many mobile clients and API callers do not, so it looks fixed on your machine and broken for others.

Install the full chain (your certificate plus the intermediates your CA provides) and confirm a scan reports a complete, trusted chain.

Never let it expire again

Manual renewal is what causes outages. Switch to automated issuance - Let's Encrypt via certbot or an ACME client, or a host that manages TLS for you - so certificates renew weeks before they expire without anyone remembering.

As a backstop, set a calendar reminder two weeks ahead of the expiry date, or watch the domain so you get an email while there is still time to act.

Frequently asked questions

How long does it take to fix an expired certificate?

With managed or automated TLS, minutes once renewal runs. A manual CA re-issue plus install and server reload typically takes well under an hour.

Why does my certificate still show as expired after renewing?

Usually the web server is still serving the old certificate from memory, or your browser cached it. Reload the server and test in a fresh private window.

How often do SSL certificates expire?

Free and automated certificates often last 90 days; paid ones typically up to about a year. Industry maximums keep shrinking, which is why automated renewal is the norm.

Can I prevent certificate expiry entirely?

You cannot stop them expiring, but automated renewal (ACME / Let's Encrypt or managed TLS) reissues them ahead of time so they never actually lapse.