Certificate expired

Your site's SSL certificate has passed its expiry date. Until you renew it, browsers show every visitor a full-page security warning and block them from reaching your site.

Symptom

• DomainDash marks the SSL check Expired, shows a Security expired badge on the site and opens a Needs fixing incident. The Security card reads "Your certificate has expired. You'll need to renew it before your site is secure again."
• Visitors see a browser warning like "Your connection is not private" or NET::ERR_CERT_DATE_INVALID
• Running openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates shows a notAfter date in the past

What it means

SSL certificates have a fixed lifespan. Once that period ends, browsers reject the certificate and visitors land on a warning page that discourages them from going any further. This is the most common SSL issue, and it usually means a renewal step was missed.

Same error, opposite cause

NET::ERR_CERT_DATE_INVALID covers both ends of a certificate's life. If your certificate hasn't expired, check whether it's not yet valid instead. A start date in the future produces the identical browser warning.

What to do right now

Each step links to the full detail below.

1. Confirm it's expired. One openssl command tells you the notAfter date.
2. Renew with your host. Pick the one that matches you: certbot, cPanel AutoSSL, a hosted provider or CDN, or AWS Certificate Manager.
3. Reload your web server so it serves the new certificate (e.g. sudo systemctl reload nginx).
4. Verify in a fresh incognito window.
5. Stop it happening again. Fix auto-renewal and know which warnings to expect.

Common causes

• Auto-renewal failed and nobody was told. This is the most common cause: tools like Let's Encrypt's certbot, ACM, or your hosting provider's renewer ran into a problem and didn't report it.
• The renewal job stopped running: cron disabled, server rebooted without restarting it, container redeployed without persistent state.
• A new certificate was provisioned but never deployed to the live server.
• DNS or HTTP validation for renewal failed because of an unrelated DNS change.
• A manual certificate was issued for a one-off period (up to 200 days) and the renewal calendar reminder was missed.

How to fix

1. Confirm the certificate is expired. Run:

   openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

   Replace example.com with your domain. If notAfter is in the past, the certificate is expired.

2. Renew with your host. Find the walkthrough that matches how your certificate is issued, below.

3. Investigate why auto-renewal failed. Check the renewal logs (/var/log/letsencrypt/letsencrypt.log for certbot, the provider's audit log for hosted services). Common causes include DNS changes that broke validation, firewall rules blocking the validation request, and disk-space issues that stopped the renewer from writing the new certificate. Then work through Stop it happening again.

Let's Encrypt (certbot)

Run a renewal manually:

sudo certbot renew

certbot renew renews every certificate within 30 days of expiry, which includes one that has already expired. To renew a certificate that isn't due yet, add --force-renewal. Then reload your web server so it picks up the new files:

sudo systemctl reload nginx   # or: sudo systemctl reload apache2

If renewal fails, the error usually points at validation: port 80 blocked for the HTTP-01 challenge, or a DNS change that broke a DNS-01 challenge. The full output and /var/log/letsencrypt/letsencrypt.log will tell you which.

cPanel (AutoSSL)

Most cPanel hosts run AutoSSL, which issues and renews free certificates for you. If the certificate has lapsed:

1. In cPanel, open Security → SSL/TLS Status.
2. Tick the affected domains and click Run AutoSSL. cPanel will request and install a fresh certificate, usually within a few minutes.
3. If a domain shows as excluded or keeps failing, check that it resolves to this server and that there's no conflicting certificate already installed under SSL/TLS → Manage SSL sites. AutoSSL skips domains it can't validate (for example, a domain pointed at a different host or behind a proxy).

If your host disables AutoSSL, or you bought a certificate separately, install the renewed certificate under SSL/TLS → Manage SSL sites instead.

Hosted providers / CDNs

For Cloudflare, Netlify, Vercel, Fly.io, Heroku and similar platforms, open the SSL/TLS section of their dashboard and look for a renew or reissue action. Trigger it and wait for the new certificate to propagate to their edge, usually a minute or two. A stuck renewal usually means validation is failing: confirm the domain still points at the provider and that any required validation CNAME or TXT record is still in place.

AWS Certificate Manager (ACM)

ACM renews certificates automatically, but only while their validation records are still in place. An expired ACM certificate usually means DNS validation broke.

1. Open the certificate in the ACM console and check its status. If it shows Pending validation or Failed, validation is the problem.
2. For DNS-validated certificates, make sure the CNAME record ACM gave you still exists in your DNS (Route 53 or wherever your zone lives). If it was deleted or the zone moved, re-add it exactly as ACM specifies; ACM will validate and renew automatically once it can see the record.
3. ACM certificates are used by other AWS services (CloudFront, ALB, API Gateway) rather than installed on a server. Once ACM issues the renewed certificate, the attached service picks it up without a reload.

A manually managed certificate

If you bought the certificate from a certificate authority and install it yourself, request a new one (or renew it in your CA's dashboard), install the new certificate and key on your server, and reload the web server.

How to verify

After renewing and reloading:

1. Run the OpenSSL check from step 1 above. The notAfter date should now be in the future.
2. Open your site in a fresh browser window (incognito mode bypasses cached state). The padlock should appear with no warnings.
3. Open the site in DomainDash and open the Security page. At the next scheduled SSL check the Security expired badge clears and Expires under Certificate details shows the new date. If the expired certificate had also taken the site Down, this happens within minutes of the site recovering. How long does renewing take? has the timing for each plan.

Stop it happening again

Make sure auto-renewal is running, and know what warning you'll get if it stops.

Make sure auto-renewal is running

• certbot installs a systemd timer (or a cron job on older systems) that runs twice a day and renews certificates within 30 days of expiry. Check it's enabled with systemctl list-timers | grep certbot. Then do a dry run with sudo certbot renew --dry-run, which exercises the whole renewal path without touching your live certificate and shows up a broken validation or permissions problem.
• cPanel AutoSSL runs on a schedule by default. Confirm it's on under Security → SSL/TLS Status, and that the affected domains aren't excluded.
• Hosted providers and CDNs (Cloudflare, Netlify, Vercel and similar) renew automatically as long as the domain still points at them and any validation record stays in place. You don't schedule anything. Leave the validation CNAME/TXT record where it is.
• AWS Certificate Manager renews automatically while the DNS validation CNAME it issued remains in your zone. Check the record is still there after any DNS zone move.

Give yourself a safety net

A redeployed container, a disabled cron job or a deleted DNS record can stop auto-renewal without any error reaching you.

DomainDash runs SSL checks on every plan. When a certificate has 30 days or less left, the site card reads Renews · N days and the site page header reads Security expiring, unless a more serious status such as Down is showing in their place. A stalled renewal shows up while you still have weeks to fix it. At 7 days DomainDash opens an incident at Worth knowing and raises it to Needs a look at 1 day. Once that incident opens, the site card reads Alert in place of Renews · N days. If the certificate expires, a separate Needs fixing incident opens. Each appears in the app and in your daily digest. How often checks run and how long DomainDash keeps history depend on your plan: see the plan comparison and SSL certificates for what's covered.

Frequently asked questions

What does it mean when an SSL certificate expires?

Every SSL certificate is issued for a fixed period and carries a "valid until" date. After that date, browsers can't tell a stale certificate from a forged one, so they refuse to make a secure connection. Nothing is broken on your server. Publicly trusted certificates now last up to 200 days, and often 90 (Let's Encrypt), and the limit keeps falling, so renewals come round often.

What happens if my SSL certificate expires?

Visitors get a full-page security warning ("Your connection is not private" or NET::ERR_CERT_DATE_INVALID) and most leave rather than click through it. Search engines and uptime tools treat the site as unreachable. DomainDash marks the SSL check Expired, shows a Security expired badge on the site and opens a new Needs fixing incident, which appears in the app and in your daily digest. Your server keeps running, but anyone arriving over HTTPS is blocked until you renew.

How do I fix an expired SSL certificate?

Renew it and reload your web server. With Let's Encrypt and certbot, run sudo certbot renew then sudo systemctl reload nginx (or your server's equivalent). On a hosted provider or CDN (Cloudflare, Netlify, Vercel, cPanel), trigger the renew or AutoSSL action in the dashboard. On AWS, ACM renews automatically once its validation CNAME is back in your DNS. Then confirm the new expiry date with openssl. How to fix has the steps for each host.

How long does renewing take to fix the warning?

On your own server, the warning clears for new visitors within seconds of reloading the web server with the renewed certificate. A browser that cached the old certificate may need an incognito window, and hosted providers or CDNs take a minute or two to push the new certificate to their edge nodes. DomainDash's Security expired badge clears at the next scheduled SSL check: daily on Free, every 12 hours on Starter and Pro, and every 6 hours on Business. If the expired certificate had also taken the site Down, DomainDash re-checks the certificate as soon as the site recovers, so the badge clears within minutes.

Related

• Certificate not yet valid — the inverse problem (start date in the future)
• Certificate has been revoked — invalidated rather than expired
• Visitors see a security warning — if you're not sure what type of SSL issue you have
• SSL certificates — how DomainDash checks SSL