SSL certificate expired? How to fix the problem
Browsers show a warning because your SSL certificate has expired? Here is how to fix it quickly and make sure it doesn’t happen again.
Instead of your website, visitors see a full-page warning: “Your connection is not private”. Most of them leave immediately. The reason is almost always the same: the SSL certificate has expired. The good news: it can usually be fixed in a few minutes.
What an SSL certificate does
The certificate is a kind of digital ID card for your website. It confirms to the browser that it really is talking to your server and enables the encrypted connection, recognisable by https:// and the padlock icon. Every certificate has an expiry date. After that, browsers refuse to trust it.
Step 1: Check what exactly is wrong
Enter your domain into our SSL checker. You immediately see:
- whether the certificate has expired and since when,
- who issued it (for example Let’s Encrypt or a commercial provider),
- which domains it covers.
Not every warning means an expired certificate. If, for example, it only covers example.com but not www.example.com, visitors only see the warning on the www version. If an intermediate certificate is missing, the site works on a computer but not on a phone.
Step 2: Renew the certificate
How you renew the certificate depends on where your website is hosted.
On a web hosting plan (for example Hostinger, SiteGround, IONOS or GoDaddy): there is usually a menu item called “SSL” or “Certificates” in the customer area. There you can activate a free Let’s Encrypt certificate or renew an existing one. If automatic renewal is switched off, turn it on while you are there.
On your own server: if Certbot is running, renew with sudo certbot renew and then restart the web server. If renewal fails, the reason is shown in the output. Most often the domain no longer points to this server or port 80 is blocked by the firewall. On platforms such as Coolify, Plesk or cPanel, you do this through the interface.
On a website builder such as Wix, Squarespace or Jimdo, the provider takes care of the certificate. If it has still expired, the connection between your domain and the builder is usually broken. Their support can help.
With a purchased certificate: commercial certificates must be re-ordered from the provider and installed on the server. For most small websites this is not necessary. A free certificate from Let’s Encrypt encrypts just as well.
After renewing, check again with the SSL checker. If your browser still shows a warning, clear the cache or open a private window.
Why this may happen more often in future
The major browser makers and certificate authorities have agreed in the CA/Browser Forum to shorten certificate lifetimes step by step:
| From | Maximum lifetime |
|---|---|
| March 2026 | 200 days |
| March 2027 | 100 days |
| March 2029 | 47 days |
If you have been renewing a certificate by hand once a year, you would soon have to do it almost every month. That is only practical with automatic renewal. Let’s Encrypt certificates already last only 90 days and are normally renewed automatically.
How to prevent it for good
- Turn on automatic renewal and check that it still works after every server move.
- Set up a reminder. A monitoring service checks the certificate daily and warns you as soon as it has less than two weeks left. More in Website monitoring.
- Cover all versions. The certificate should cover the domain both with and without
www.
An expired certificate is not a security breach. The data on your server is not at risk. It is, however, a trust problem: visitors see a warning and leave.