SSL Certificate Expired? A Step-by-Step Recovery Checklist
An expired SSL/TLS certificate makes browsers show a full-page “Your connection is not private” warning (NET::ERR_CERT_DATE_INVALID) and stops visitors reaching your site. The fix is to renew the certificate, install the full chain, and restart the service that serves it — then set up automation so it never lapses again. Here’s the checklist.
First, confirm it’s really expiry
Not every certificate error is expiry. Check the exact problem before you touch anything — our free SSL checker shows the expiry date, days remaining, issuer, hostname coverage and chain in one look, so you know whether you’re dealing with an expired cert, a name mismatch or a broken chain.
The recovery checklist
- Renew the certificate. With Let’s Encrypt/ACME, run your client’s renew command (e.g.
certbot renew). With a commercial CA, reissue from your dashboard. Certificates from public CAs have short lifetimes now, so renewals are routine. - Install the full chain, not just the leaf. Deploy the leaf certificate plus its intermediate(s). A leaf-only install passes in some browsers but fails in others and in many API clients that can’t build a path to a trusted root.
- Restart or reload the service. A renewed file on disk does nothing until the web server, load balancer or proxy reloads it. Reload nginx/Apache/your ingress — and remember any CDN or terminating proxy in front of it needs the new cert too.
- Verify from the outside. Re-check the live site (not just the file) to confirm the served certificate is the new one, the chain is complete and the dates are right.
- Clear intermediate caches. If you use a CDN or reverse proxy, purge or let it pick up the new certificate so old cached TLS sessions don’t linger.
Prevent the next one
Expiry is entirely avoidable:
- Automate renewal. ACME clients renew at roughly one-third of the certificate’s lifetime; make sure the renew timer/cron is actually running and the reload hook fires.
- Monitor expiry independently. Automation fails silently — a renew hook that stopped, a permissions change, a cert that’s requested but never deployed. An external monitor that alerts at 30, 14 and 7 days is your safety net. That’s exactly what SSL monitoring does.
- Watch every hostname. Apex,
www, API subdomains and mail hosts can be on different certificates with different dates.
One report, all five
A certificate is one of five things that quietly break a domain. Run the full health check to see SSL alongside blacklist, email auth, expiry and DNS.
Sources
- Let’s Encrypt — How It Works / certificate lifecycle & renewal: https://letsencrypt.org/how-it-works/
- Chrome error reference (
NET::ERR_CERT_DATE_INVALID): https://support.google.com/chrome/answer/6098869