Nuestros artículos del blog están escritos en inglés. El resto del sitio está disponible en tu idioma.
Monitoring
SSL certificate expired? What it means and how to fix it
When an SSL certificate expires, browsers show a full page warning and most visitors leave. Here is what happens, how to fix it in the right order, and how to make sure it never surprises you again.
An expired SSL certificate means the certificate that proves your site's identity has passed its end date, so browsers no longer trust the connection. Visitors see a full page warning instead of your site, and most of them leave. The fix is to renew the certificate, install it with its full chain on every server that serves the site, and then set up renewal and expiry alerts so it can't happen again.
If your SSL certificate expired, this guide covers what visitors and search engines see, the fastest way to fix it, and why expiries are becoming more common.
What happens when an SSL certificate expires?
When a certificate expires, browsers block the page with a warning such as "Your connection is not private" or "Warning: Potential Security Risk Ahead". Visitors can sometimes click through, but few do. At the same time:
- Forms and checkouts stop working for visitors who don't click through.
- APIs and apps that call your site fail, because most clients refuse expired certificates outright.
- Email links and ads land on a warning page, wasting the clicks you paid for.
- Search engines may have trouble crawling the HTTPS version until it's fixed.
A short expiry, fixed within hours, rarely has a lasting SEO effect. A long one does real damage, mostly because visitors and crawlers can't reach your pages.
Why SSL certificates expire
Every certificate has a fixed lifetime. The most common reasons a renewal is missed:
| Cause | What went wrong |
|---|---|
| Auto renewal failed | The renewal job errored and nobody saw the log |
| DNS or HTTP validation failed | The domain moved, so the authority couldn't verify it |
| Manual certificate | Someone bought it once and the reminder went to an old inbox |
| Renewed but not installed | The new file sits on disk, but the server still serves the old one |
| One server missed | A load balancer, CDN or second server still has the old certificate |
Lifetimes are also getting shorter. Browser makers and certificate authorities agreed to cut the maximum lifetime of public certificates in stages, to 200 days from March 2026 and down to 47 days by 2029. Certificates from Let's Encrypt already last 90 days. Shorter lifetimes are safer, but they make automation and monitoring essential.
How to fix an expired SSL certificate
- Confirm the problem. Check the certificate's dates, the names it covers and the chain. Sometimes the certificate is fine, and a missing intermediate certificate or a wrong host name causes the warning.
- Renew the certificate. With an ACME client like Certbot, run the renewal command. With a paid certificate, renew it with your provider and complete validation.
- Install the full chain. Install the certificate together with its intermediate certificates. A missing intermediate works in some browsers and fails in others.
- Reload every server. Reload the web server, and update the certificate on any CDN, load balancer or proxy in front of it.
- Check again from outside. Test the live site, including both the bare domain and the www version.
- Find out why renewal failed, and fix that, or it will happen again.
If you don't have a certificate provider, Let's Encrypt's getting started guide explains how to get a certificate with automatic renewal.
SSL errors that look like an expired certificate
Not every certificate warning means the certificate expired. Before you renew, check which error the browser actually shows:
| Warning | What it means | Fix |
|---|---|---|
| Certificate expired | The end date has passed | Renew and install the new certificate |
| Name mismatch | The certificate doesn't cover this host, such as www | Add the missing name to the certificate |
| Incomplete chain | An intermediate certificate is missing | Install the full chain file |
| Self signed or untrusted | No trusted authority issued it | Use a certificate from a trusted authority |
| Clock problem | The visitor's device date is wrong | Nothing on your side; the visitor fixes their clock |
A name mismatch is especially common after adding a subdomain or moving between www and the bare domain. It looks just as alarming to visitors as an expired certificate.
How to stop SSL certificates from expiring again
- Automate renewal with an ACME client, and alert on renewal errors, not just on success.
- Monitor the live certificate, not only the renewal job. What matters is what visitors actually receive.
- Alert well before expiry, for example at 30, 14 and 7 days.
- Watch the domain too. An expired domain registration takes the whole site down, certificate included.
- Keep an inventory of every host and subdomain with a certificate, including staging and API hosts.
Check a certificate with the SSL Checker
The SSL Checker opens a secure connection to a site and reads its certificate: who issued it, when it expires, which names it covers, including the www version, and the full chain, so a missing intermediate certificate stands out. It also shows which TLS versions the server accepts and looks up when the domain itself expires, with no access to your server needed.
For checks around the clock, the Uptime Monitor watches certificates along with page availability and sends an alert before anything lapses. If the site won't load at all, start with the Website Down Checker to see whether DNS, the connection, the certificate or the server is failing.
Etiquetas
- ssl certificate
- https
- website security
- monitoring
Preguntas y respuestas
What happens if my SSL certificate expires?
Browsers show a full page security warning and most visitors leave. Apps and APIs that connect to your site usually fail completely until a valid certificate is installed.
Does an expired SSL certificate affect SEO?
A short expiry fixed within hours rarely has a lasting effect. A long one can hurt, because visitors and crawlers can't reach your pages normally while the warning is shown.
How do I renew an expired SSL certificate?
Renew it with your ACME client or provider, install it with its full chain, reload every server and CDN that serves the site, then test the live site from outside.
How long does an SSL certificate last?
Let's Encrypt certificates last 90 days. The maximum for public certificates is being cut in stages, to 200 days from March 2026 and to 47 days by 2029, so automatic renewal matters more each year.