SSL Certificate Expired? What It Means and How to Fix It

Updated March 2026 · 8 min read

If you are reading this because your site is already showing a security warning, take a breath. An expired SSL certificate is stressful, but it is also one of the most fixable problems in web security. This guide will walk you through exactly what is happening, why it happened, and how to resolve it as quickly as possible.

What Is an SSL Certificate?

An SSL/TLS certificate is a small data file that creates an encrypted connection between your web server and your visitors' browsers. When a certificate is active and valid, your site loads over HTTPS, and browsers display a padlock icon in the address bar. That padlock tells visitors two things: the connection is encrypted so data cannot be intercepted in transit, and the site has been verified to belong to the domain it claims to be.

SSL certificates protect everything from login credentials and credit card numbers to simple form submissions. They are a foundational layer of trust on the modern web, and every public-facing website is expected to have one. Search engines, browsers, and payment processors all treat a valid SSL certificate as a baseline requirement rather than an optional extra.

What Happens When Your SSL Certificate Expires

When your SSL certificate passes its expiration date, the consequences are immediate and visible. Nothing breaks silently in the background. Instead, your visitors are confronted with full-screen browser warnings that are specifically designed to look alarming.

Here is what that means in practice:

• Visitors cannot reach your site. Browsers hide your content behind a warning page. Users must manually click through multiple steps to proceed, and most will not. Studies consistently show that more than 85% of visitors will leave rather than bypass a certificate warning.
• Search rankings can drop. Google has treated HTTPS as a ranking signal since 2014. An expired certificate effectively removes your site from HTTPS status. The resulting spike in bounce rate sends additional negative signals to search engines.
• Payment processing stops. PCI DSS compliance requires a valid SSL certificate. If your certificate expires, payment gateways will refuse to process transactions, meaning your checkout is completely broken.
• API integrations break. Any service that connects to your domain over HTTPS will start throwing certificate errors. Webhooks, third-party scripts, mobile apps that call your API, and partner integrations will all fail.
• Customer trust is damaged. Even after you fix the certificate, some visitors who saw the warning may hesitate to return. The phrase "not secure" sticks in people's minds, especially for ecommerce and financial services sites.
• Email delivery can be affected. If your mail server uses the same certificate, encrypted email connections (STARTTLS) may fail, causing delivery delays or bounces.

The severity scales with every minute the certificate remains expired. For businesses, an expired certificate during business hours can mean lost revenue measured in the thousands of dollars per hour.

Why SSL Certificates Expire

SSL certificates are intentionally designed to expire. This is not a flaw. It is a security feature.

Certificate Authorities (CAs) issue certificates with a limited validity period so that domain ownership and organizational details are periodically re-verified. If a certificate lasted forever, a domain could change hands, a company could close down, or an encryption algorithm could become outdated, and the certificate would still appear valid.

The current maximum validity period for publicly trusted SSL certificates is 398 days (approximately 13 months). Let's Encrypt certificates are valid for 90 days. The industry is steadily moving toward shorter lifespans. Both Apple and Google have advocated for 90-day maximums across all certificate authorities, and this is expected to become the standard in the near future.

Shorter certificate lifetimes mean that automated renewal is no longer optional. It is essential. A 90-day certificate that requires manual renewal four times a year is almost guaranteed to be forgotten eventually.

How to Check Your SSL Certificate Expiry Date

Use GuardHound's SSL Checker (fastest method)

Enter your domain in the GuardHound SSL Checker for an instant report that shows your certificate's expiry date, issuer, protocol version, and any configuration issues. No installation or technical knowledge required.

Browser method

1. Navigate to your website in Chrome (or any browser).
2. Click the padlock icon (or "Not secure" label) in the address bar.
3. Click Connection is secure (or Certificate in some browsers).
4. Look for the Valid to or Expires on date in the certificate details.

Command line method

If you have terminal access, you can check any domain's certificate expiry with OpenSSL:

echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates

This outputs the notBefore and notAfter dates for the certificate. The notAfter value is your expiration date.

How to Renew Your SSL Certificate

The renewal process depends on how your certificate was issued. Here are the most common scenarios:

Let's Encrypt (free certificates)

If you use Let's Encrypt with Certbot, renewal is a single command:

sudo certbot renew

Certbot will check all certificates on the server and renew any that are within 30 days of expiry. After renewal, restart your web server to load the new certificate:

sudo systemctl reload nginx

or

sudo systemctl reload apache2

Hosting provider certificates

If your hosting provider manages your SSL (common with shared hosting), renewal usually happens through your hosting dashboard. Look for SSL/TLS settings in cPanel, Plesk, or your provider's custom panel. Many hosting providers offer one-click renewal or automatic renewal that just needs to be enabled.

Paid certificates (DigiCert, Sectigo, Comodo, GlobalSign)

1. Log in to your certificate provider's dashboard.
2. Generate a new Certificate Signing Request (CSR) from your server.
3. Submit the CSR and complete any required validation (domain, organization, or extended validation).
4. Download the new certificate files and install them on your server.
5. Restart your web server to apply the new certificate.

Common hosting platforms

• Cloudflare: Free Universal SSL is managed automatically. If you use a custom certificate, upload the replacement in the SSL/TLS section of your dashboard.
• AWS (ACM): Certificates issued through AWS Certificate Manager renew automatically as long as the domain's DNS is still pointed correctly.
• Netlify / Vercel: SSL is managed automatically via Let's Encrypt. Renewal happens in the background with no action needed.
• WordPress (cPanel): Look for the SSL/TLS Status page in cPanel, then click "Run AutoSSL" to force a renewal check.

How to Set Up Auto-Renewal

Setting up auto-renewal is the single most important thing you can do to prevent future SSL expiry issues. Here is how to do it with the most common tools:

Let's Encrypt + Certbot

Certbot installs a cron job or systemd timer automatically on most systems. You can verify it is active:

sudo systemctl status certbot.timer

If the timer is not enabled, you can add a cron job manually:

echo "0 3 * * * root certbot renew --quiet --deploy-hook 'systemctl reload nginx'" | sudo tee /etc/cron.d/certbot-renew

This runs the renewal check daily at 3:00 AM and automatically reloads your web server when a certificate is renewed.

Hosting provider auto-renewal

Most hosting providers offer an auto-renewal toggle in their SSL settings. Enable it. If your provider charges for SSL, make sure your payment method on file is current so the renewal is not blocked by a declined payment.

How GuardHound Prevents SSL Surprises

Auto-renewal handles the expected case. GuardHound handles the unexpected one. Even well-configured auto-renewal can fail silently, and you may not find out until visitors start complaining or your traffic drops.

GuardHound monitors your SSL certificate continuously and sends you alerts at 30 days, 14 days, and 7 days before your certificate expires. If your auto-renewal worked, you never need to think about these alerts. If something went wrong, you get advance warning with enough time to fix it before a single visitor sees a browser warning.

Beyond expiry monitoring, GuardHound's tools help you stay on top of your entire domain security posture:

• SSL Checker — Instant certificate inspection: expiry date, issuer, protocol version, certificate chain, and configuration issues.
• Domain Health Check — A comprehensive scan that covers SSL, DNS, DMARC, SPF, and more in a single report.
• Continuous Monitoring — Set up ongoing monitoring for your domains and get alerted the moment anything changes or needs attention.