[{"data":1,"prerenderedAt":292},["ShallowReactive",2],{"content:\u002Fguides\u002Fssl-certificate-expired-how-to-fix":3,"related:\u002Fguides\u002Fhow-to-track-domain-and-ssl-expiry-dates,\u002Ffeatures\u002Fdomain-ssl-expiry-tracker,\u002Fguides\u002Fwebsite-monitoring-checklist-for-freelancers":280},{"id":4,"title":5,"body":6,"category":252,"description":253,"extension":254,"faq":255,"h1":268,"meta":269,"navigation":270,"path":271,"published":272,"readingMinutes":273,"related":274,"seo":277,"stem":278,"updated":272,"__hash__":279},"guides\u002Fguides\u002Fssl-certificate-expired-how-to-fix.md","SSL certificate expired? How to fix it",{"type":7,"value":8,"toc":236},"minimark",[9,13,18,21,47,57,64,71,75,78,83,86,90,93,97,100,106,109,113,116,120,142,146,149,181,185,188,192,224,228],[10,11,12],"p",{},"An expired certificate turns a working website into a full-page warning. Visitors cannot get past it without clicking through a security message, and most will not. The good news is that it is one of the easiest outages to fix, and one of the easiest to prevent.",[14,15,17],"h2",{"id":16},"how-do-i-confirm-the-certificate-has-expired","How do I confirm the certificate has expired?",[10,19,20],{},"Check before you change anything, because the same warning appears for other problems.",[22,23,24,41],"ul",{},[25,26,27,31,32,36,37,40],"li",{},[28,29,30],"strong",{},"In the browser:"," open the page and look at the warning. Chrome shows ",[33,34,35],"code",{},"NET::ERR_CERT_DATE_INVALID"," and Firefox shows ",[33,38,39],{},"SEC_ERROR_EXPIRED_CERTIFICATE"," when the date is the problem.",[25,42,43,46],{},[28,44,45],{},"From a terminal:"," read the end date directly.",[48,49,55],"pre",{"className":50,"code":52,"language":53,"meta":54},[51],"language-bash","openssl s_client -connect example.com:443 -servername example.com \u003C\u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | openssl x509 -noout -dates\n","bash","",[33,56,52],{"__ignoreMap":54},[10,58,59,60,63],{},"If ",[33,61,62],{},"notAfter"," is in the past, the certificate has expired. If it is in the future, look for another cause, such as a wrong date on the device you are testing from, a certificate for the wrong hostname or a missing intermediate certificate.",[10,65,66,67,70],{},"Check every hostname that serves the site. The main domain, the ",[33,68,69],{},"www"," version, a staging site and a shop on another subdomain each have their own certificate unless a wildcard covers them.",[14,72,74],{"id":73},"how-do-i-renew-an-expired-ssl-certificate","How do I renew an expired SSL certificate?",[10,76,77],{},"The steps depend on who issues and installs the certificate.",[79,80,82],"h3",{"id":81},"the-host-manages-it-netlify-vercel-cloudflare-and-similar","The host manages it (Netlify, Vercel, Cloudflare and similar)",[10,84,85],{},"Open the domain settings in the host's dashboard and trigger a new certificate. If it refuses, the usual reason is DNS: the domain no longer points at the host, or a record needed for validation was removed. Fix the record, then retry.",[79,87,89],{"id":88},"shared-hosting-or-a-control-panel","Shared hosting or a control panel",[10,91,92],{},"Look for the SSL or AutoSSL section of the control panel and run the renewal or reinstall the certificate. If it fails, check that the domain still points at that account.",[79,94,96],{"id":95},"a-server-you-manage-with-lets-encrypt","A server you manage with Let's Encrypt",[10,98,99],{},"On many systems the certificate tool is certbot. Test the renewal first, then run it:",[48,101,104],{"className":102,"code":103,"language":53,"meta":54},[51],"sudo certbot renew --dry-run\nsudo certbot renew\nsudo systemctl reload nginx\n",[33,105,103],{"__ignoreMap":54},[10,107,108],{},"Reload whichever web server you run, so it picks up the new files. If the dry run fails, the message says why. Typical causes are port 80 being blocked, the web server configuration changing the validation path, or a DNS record no longer pointing at the server.",[79,110,112],{"id":111},"a-paid-certificate","A paid certificate",[10,114,115],{},"Reissue it with the certificate authority, complete the validation they ask for and install the new certificate together with the intermediate chain. Using only the certificate file without the chain causes errors on some devices.",[14,117,119],{"id":118},"how-do-i-check-that-the-fix-worked","How do I check that the fix worked?",[121,122,123,130,133,136,139],"ol",{},[25,124,125,126,129],{},"Run the ",[33,127,128],{},"openssl"," command again and confirm the new end date.",[25,131,132],{},"Open the site in a private window on a different network and device.",[25,134,135],{},"Check every hostname again, including subdomains.",[25,137,138],{},"If the site sits behind a CDN or caching layer, purge it so the new certificate is served everywhere.",[25,140,141],{},"Check anything else that uses the certificate, such as a mail server or an API.",[14,143,145],{"id":144},"why-did-the-certificate-not-renew-on-its-own","Why did the certificate not renew on its own?",[10,147,148],{},"Find the cause now, or it will happen again.",[22,150,151,157,163,169,175],{},[25,152,153,156],{},[28,154,155],{},"A DNS or validation change."," Renewal needs a file or a DNS record to be reachable. A migration or cleanup can remove it.",[25,158,159,162],{},[28,160,161],{},"A blocked port or firewall."," Some renewal methods need port 80 or 443 to be open.",[25,164,165,168],{},[28,166,167],{},"A stopped renewal job."," The scheduled task or timer was removed or never started after a server rebuild.",[25,170,171,174],{},[28,172,173],{},"A plan or account change."," A host that moved the site, or an account that was closed, no longer renews anything.",[25,176,177,180],{},[28,178,179],{},"Nobody owned it."," A paid certificate with a one-year term was bought once and forgotten.",[14,182,184],{"id":183},"what-do-i-tell-the-client","What do I tell the client?",[10,186,187],{},"Keep it short and factual: what happened, when it was fixed and what you changed so it will not repeat. If you monitor expiry dates, say so. Clients take an outage much better when it comes with a fix and a prevention step.",[14,189,191],{"id":190},"how-do-i-stop-it-happening-again","How do I stop it happening again?",[22,193,194,206,212,218],{},[25,195,196,199,200,205],{},[28,197,198],{},"Track every certificate's end date"," in one place, not only the main domain. Our guide on ",[201,202,204],"a",{"href":203},"\u002Fguides\u002Fhow-to-track-domain-and-ssl-expiry-dates","tracking domain and SSL expiry dates"," walks through the process.",[25,207,208,211],{},[28,209,210],{},"Alert before it fails."," A warning a week before the end date and another in the last few days is enough. Automatic renewal normally happens well before expiry, so a certificate close to its end date usually means renewal has already failed.",[25,213,214,217],{},[28,215,216],{},"Expect shorter lifetimes."," Public certificates are being limited in stages, to 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029, so manual renewal gets harder every year. Confirm the schedule with the CA\u002FBrowser Forum.",[25,219,220,223],{},[28,221,222],{},"Test renewal after any server or DNS change."," A dry run takes seconds.",[14,225,227],{"id":226},"where-datumboard-fits","Where Datumboard fits",[10,229,230,231,235],{},"Datumboard reads the certificate date of every site you add and shows it in one renewal calendar with your domains, tokens and subscriptions. It marks an item due soon within 14 days and critical within three, and shows Not available when a date cannot be read instead of pretending everything is fine. It is in early access, and you can ",[201,232,234],{"href":233},"#early-access","join the list below",".",{"title":54,"searchDepth":237,"depth":237,"links":238},2,[239,240,247,248,249,250,251],{"id":16,"depth":237,"text":17},{"id":73,"depth":237,"text":74,"children":241},[242,244,245,246],{"id":81,"depth":243,"text":82},3,{"id":88,"depth":243,"text":89},{"id":95,"depth":243,"text":96},{"id":111,"depth":243,"text":112},{"id":118,"depth":237,"text":119},{"id":144,"depth":237,"text":145},{"id":183,"depth":237,"text":184},{"id":190,"depth":237,"text":191},{"id":226,"depth":237,"text":227},"How-to","Visitors see a full-page browser warning. Confirm the certificate expired, renew it for your kind of hosting, verify the fix and stop it happening again.","md",[256,259,262,265],{"q":257,"a":258},"Why does my browser say the connection is not private after the certificate expired?","Browsers refuse to trust a certificate outside its validity dates, so they stop the page load and show a full-page warning such as NET::ERR_CERT_DATE_INVALID in Chrome. The site itself can still be running, but visitors cannot continue without clicking through a warning most of them will not accept.",{"q":260,"a":261},"How long does it take to fix an expired SSL certificate?","If your host or a tool such as certbot can issue a new certificate, it is usually a matter of minutes. A paid certificate that has to be reissued by a certificate authority and installed by hand can take longer, mostly because of validation and a possible server restart.",{"q":263,"a":264},"Does an expired certificate hurt SEO?","A short outage rarely does lasting harm, but while the warning is showing visitors leave and crawlers cannot fetch pages over HTTPS. Fix it quickly, confirm that every page loads again and watch Search Console for crawl errors in the following days.",{"q":266,"a":267},"Why did my certificate not renew automatically?","The usual causes are a changed DNS record or removed validation file, a closed port or changed firewall that blocks the renewal check, a stopped renewal job, a hosting plan that was moved or cancelled, and an old paid certificate nobody put on a calendar.","SSL certificate expired? How to fix it and stop it happening again",{},true,"\u002Fguides\u002Fssl-certificate-expired-how-to-fix","2026-10-12",8,[203,275,276],"\u002Ffeatures\u002Fdomain-ssl-expiry-tracker","\u002Fguides\u002Fwebsite-monitoring-checklist-for-freelancers",{"title":5,"description":253},"guides\u002Fssl-certificate-expired-how-to-fix","DAI3aZyVMwzcgY_brChSgPXpLxZqTCv9715d9-pVrOM",[281,284,288],{"title":282,"description":283,"path":203,"category":252},"Track domain and SSL expiry dates for clients","Why domains and SSL certificates lapse, how to check any expiry date in one command, and a repeatable process for tracking every client's renewals in time.",{"title":285,"description":286,"path":275,"category":287},"Domain and SSL expiry tracker for every site","Datumboard reads certificate and domain expiry dates for your sites and puts them in one renewal calendar with your tokens, subscriptions and contracts.","Feature",{"title":289,"description":290,"path":276,"category":291},"Website monitoring checklist for freelancers","A practical checklist of what to monitor on every client website, from uptime and SSL to domains, deploys and search, and how often to check each.","Checklist",1791830036116]