Certificate expired

Your site's SSL certificate has passed its expiry date. Until you renew it, browsers show every visitor a full-page security warning and block them from reaching your site.

Symptom

• DomainDash marks the SSL check Expired and raises a critical Security expired badge on the site (the site needs attention)
• Visitors see a browser warning like "Your connection is not private" or NET::ERR_CERT_DATE_INVALID
• Running openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates shows a notAfter date in the past

What it means

SSL certificates have a fixed lifespan. Once that period ends, the certificate is no longer valid and browsers reject it. Visitors land on a warning page that strongly discourages them from going any further, so even a healthy site stops earning trust and traffic. This is the most common SSL issue by a wide margin, and it almost always means a renewal step was missed.

Same error, opposite cause

NET::ERR_CERT_DATE_INVALID covers both ends of a certificate's life. If your certificate hasn't actually expired, check whether it's not yet valid instead. A start date in the future (usually clock skew) produces the identical browser warning.

What to do right now

In a hurry? This is the fastest path to a renewed certificate. Each step links to the full detail below.

1. Confirm it's really expired. One openssl command tells you the notAfter date.
2. Renew with your host. Pick the one that matches you: certbot, cPanel AutoSSL, a hosted provider or CDN, or AWS Certificate Manager.
3. Reload your web server so it serves the new certificate (e.g. sudo systemctl reload nginx).
4. Verify in a fresh incognito window, then let DomainDash's next SSL check clear the badge on its own.
5. Stop it happening again. Fix auto-renewal and turn on expiry warnings.

Common causes

• Auto-renewal failed silently, the most common cause. Tools like Let's Encrypt's certbot, ACM, or your hosting provider's renewer ran into a problem and didn't tell anyone.
• The renewal job stopped running: cron disabled, server rebooted without restarting it, container redeployed without persistent state.
• A new certificate was provisioned but never deployed to the live server.
• DNS or HTTP validation for renewal failed because of an unrelated DNS change.
• A manual certificate was issued for a one-off period (e.g. 12 months) and the renewal calendar reminder was missed.

How to fix

1. Confirm the certificate is actually expired. Run:

   openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

   Replace example.com with your domain. If notAfter is in the past, the certificate is expired.

2. Renew with your host. Find the walkthrough that matches how your certificate is issued, below.

3. Investigate why auto-renewal failed. Check the renewal logs (/var/log/letsencrypt/letsencrypt.log for certbot, the provider's audit log for hosted services). Common causes include DNS changes that broke validation, firewall rules blocking the validation request, and disk-space issues that stopped the renewer from writing the new certificate. Then turn on auto-renewal and expiry warnings so it doesn't repeat.

Let's Encrypt (certbot)

Run a renewal manually:

sudo certbot renew

certbot renew only renews certificates that are within 30 days of expiry, which is fine here since yours has already lapsed. If it reports nothing to renew, add --force-renewal. Then reload your web server so it picks up the new files:

sudo systemctl reload nginx   # or: sudo systemctl reload apache2

If renewal fails, the error usually points at validation: port 80 blocked for the HTTP-01 challenge, or a DNS change that broke a DNS-01 challenge. The full output and /var/log/letsencrypt/letsencrypt.log will tell you which.

cPanel (AutoSSL)

Most cPanel hosts run AutoSSL, which issues and renews free certificates for you. If it's lapsed:

1. In cPanel, open Security → SSL/TLS Status.
2. Tick the affected domains and click Run AutoSSL. cPanel will request and install a fresh certificate, usually within a few minutes.
3. If a domain shows as excluded or keeps failing, check that it resolves to this server and that there's no conflicting certificate already installed under SSL/TLS → Manage SSL sites. AutoSSL skips domains it can't validate (for example, a domain pointed at a different host or behind a proxy).

If your host disables AutoSSL, or you bought a certificate separately, install the renewed certificate under SSL/TLS → Manage SSL sites instead.

Hosted providers / CDNs

For Cloudflare, Netlify, Vercel, Fly.io, Heroku and similar platforms, open the SSL/TLS section of their dashboard and look for a renew or reissue action. Trigger it and wait for the new certificate to propagate to their edge, usually a minute or two. If the renewal is stuck, it's almost always a validation problem: confirm the domain still points at the provider and that any required validation CNAME or TXT record is still in place.

AWS Certificate Manager (ACM)

ACM certificates renew themselves automatically, but only while their validation records are still in place. A certificate that expired in ACM almost always means DNS validation broke.

1. Open the certificate in the ACM console and check its status. If it shows Pending validation or Failed, validation is the problem.
2. For DNS-validated certificates, make sure the CNAME record ACM gave you still exists in your DNS (Route 53 or wherever your zone lives). If it was deleted or the zone moved, re-add it exactly as ACM specifies; ACM will validate and renew automatically once it can see the record.
3. Remember that ACM certificates are used by other AWS services (CloudFront, ALB, API Gateway) rather than installed on a server directly. Once ACM issues the renewed certificate, the attached service picks it up. There's nothing to reload by hand.

A manually managed certificate

If you bought the certificate from a certificate authority and install it yourself, request a new one (or renew it in your CA's dashboard), install the new certificate and key on your server, and reload the web server.

How to verify

After renewing and reloading:

1. Run the OpenSSL check from step 1 above. The notAfter date should now be in the future.
2. Open your site in a fresh browser window (incognito mode bypasses cached state). The padlock should appear with no warnings.
3. Open the site in DomainDash and go to the Security tab. DomainDash re-checks on its normal schedule, so once the renewed certificate is live the Security expired badge clears on the next SSL check. There's nothing to trigger. The certificate card then shows the new notAfter date with a healthy state.

Stop it happening again

An expired certificate is almost always a renewal that should have happened automatically and didn't. The lasting fix is to make sure auto-renewal is running, and to give yourself a warning if it ever stops.

Make sure auto-renewal is actually running

• certbot installs a systemd timer (or a cron job on older systems) that renews certificates twice a day, renewing only those within 30 days of expiry. Check it's enabled with systemctl list-timers | grep certbot, and do a dry run with sudo certbot renew --dry-run, which exercises the whole renewal path without touching your live certificate, so it surfaces a broken validation or permissions problem before it bites.
• cPanel AutoSSL runs on a schedule by default. Confirm it's on under Security → SSL/TLS Status, and that the affected domains aren't excluded.
• Hosted providers and CDNs (Cloudflare, Netlify, Vercel and similar) renew automatically as long as the domain still points at them and any validation record stays in place. There's nothing to schedule, just don't remove the validation CNAME/TXT.
• AWS Certificate Manager renews automatically too, provided the DNS validation CNAME it issued remains in your zone. The most common cause of an "auto-renewing" ACM certificate expiring is that record being deleted or the DNS zone being moved.

Give yourself a safety net

Auto-renewal is reliable right up until it isn't. A redeployed container, a disabled cron job, or a deleted DNS record can all stop it silently. The point of an expiry warning is to catch that gap before your visitors do.

DomainDash runs SSL checks on every plan and flags certificates approaching expiry up to 30 days in advance, so a stalled renewal shows up as a warning while you still have weeks to fix it — not as a midnight outage. You'll be alerted on whatever channels your plan supports. How often checks run and how long history is kept depend on your plan; see the plan comparison and SSL certificates for what's covered.

Frequently asked questions

What does it mean when an SSL certificate expires?

Every SSL certificate is issued for a fixed period and stamped with a "valid until" date. When that date passes, the certificate is no longer trusted. Browsers can't tell a genuine-but-stale certificate from a forged one, so they treat it as invalid and refuse to make a secure connection. Nothing is broken on your server; the certificate has simply aged out and needs renewing. Most certificates today last 90 days (Let's Encrypt) or up to a year, and the lifespans keep getting shorter, so renewals come round more often than people expect.

What happens if my SSL certificate expires?

Visitors get a full-page security warning ("Your connection is not private" or NET::ERR_CERT_DATE_INVALID) and most will leave rather than click through it. Search engines and uptime tools treat the site as unreachable, so traffic and trust drop straight away. DomainDash marks the SSL check Expired and raises a critical Security expired badge on the site (so the site needs attention), and alerts you on the channels your plan supports. The site itself keeps running (the content is fine), but to anyone arriving over HTTPS it's effectively offline until you renew.

How do I fix an expired SSL certificate?

Renew it and reload your web server. If you use Let's Encrypt with certbot, run sudo certbot renew then sudo systemctl reload nginx (or your server's equivalent). On a hosted provider or CDN (Cloudflare, Netlify, Vercel, cPanel), trigger the renew or AutoSSL action in the dashboard. On AWS, ACM renews automatically once DNS validation is in place, so a stuck renewal usually means the validation CNAME is missing. After renewing, confirm the new expiry date with openssl and check the site in a fresh browser window. The detailed steps above walk through each host.

How long does renewing take to fix the warning?

The certificate is valid the moment your web server is reloaded with it, so a renew-and-reload on your own server clears the warning within seconds for new visitors. Two things can add a short delay: a browser that cached the bad certificate (open an incognito window to bypass it), and hosted providers or CDNs that need a minute or two to push the new certificate to their edge nodes. DomainDash re-checks on its normal schedule, so the Security expired badge clears automatically on the next SSL check, usually within minutes of the renewed certificate going live. There's nothing to trigger by hand.

Related

• Certificate not yet valid — the inverse problem (start date in the future)
• Certificate has been revoked — invalidated rather than expired
• Visitors see a security warning — if you're not sure what type of SSL issue you have
• SSL certificates — how DomainDash checks SSL