How to Resolve an Expired SSL Certificate

An expired SSL certificate can trigger browser security warnings and interrupt access to a website. This guide explains the causes, operational impact, recovery steps, and preventive measures.

1. Why SSL Certificates Expire

1. Limited Certificate Lifetimes

Certificate validity:

• Let's Encrypt certificates have traditionally used a 90-day lifetime; check the validity of your issued certificate.
• Commercial subscription terms and individual certificate lifetimes are different; renewal or reissuance may be required during a subscription.
• Every certificate has an expiration date.

Why validity periods are limited:

• Security: Shorter lifetimes limit how long a compromised key can remain associated with a valid certificate.
• Compliance: Publicly trusted certificates must comply with the applicable CA/Browser Forum validity limits.
• Revalidation: Renewal provides an opportunity to verify continued control or identity.

2. Missed Renewal

Common causes:

• No expiration reminders are configured.
• Certificate management is inconsistent.
• Certificates are managed separately across multiple systems.
• Renewal is not automated.

2. The Impact of Expired Certificates

1. Browser Warnings

Chrome/Edge：

• Displays "Your connection is not private".
• Displays the NET::ERR_CERT_DATE_INVALID error.
• May block access to the website.

Firefox：

• Displays "Secure Connection Failed".
• Displays the SEC_ERROR_EXPIRED_CERTIFICATE error.
• May require a manual exception where the browser permits one.

Safari：

• Displays "This Connection Is Not Private".
• May block access to the website.

2. Business Impact

User experience:

• Visitors cannot access the website normally.
• Security warnings reduce trust.
• Visitors may leave the website.

Search visibility:

• Prolonged accessibility problems can affect search performance.
• Crawling and indexing may be affected.

Security risks:

• Users may become accustomed to bypassing security warnings.
• Bypassing certificate validation can expose users to man-in-the-middle attacks.

3. Check Whether a Certificate Has Expired

1. Check in a Browser

Chrome/Edge：

1. Open the connection security information in the address bar
2. Open the certificate viewer
3. Check the "Valid until" date.

Firefox：

1. Open the connection security information in the address bar
2. Open Connection secure → More information
3. Click View certificate
4. Check the "Valid until" date.

2. Command-line checks

# Inspect the certificate with OpenSSL
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

# Check the HTTPS connection with curl
curl -vI https://example.com 2>&1 | grep -i "expire"

# Inspect a local certificate file
openssl x509 -in certificate.crt -noout -dates

3. Use an Online Checker

SSL Labs：

• Visit https://www.ssllabs.com/ssltest/
• Enter the domain to inspect the certificate validity period.

SSL Checker：

• Visit https://www.sslshopper.com/ssl-checker.html.
• Enter the domain to view certificate details.

4. Replace an Expired Certificate

1. Renew Immediately

Renew with CertOne:

1. Sign in to CertOne
2. Find the expired certificate.
3. Click Renew
4. Complete validation; configured DNS authorization can automate this step.
5. Download the new certificate.
6. Deploy it to the server.

Renew with acme.sh:

# Renew the certificate manually
~/.acme.sh/acme.sh --renew -d example.com

# Force renewal
~/.acme.sh/acme.sh --renew -d example.com --force

Renew with Certbot:

# Renew the certificate
sudo certbot renew

# Force renewal of a specific certificate
sudo certbot renew --cert-name example.com --force-renewal

2. Update the Server Configuration

Nginx：

# Upload the new certificate
sudo cp new_certificate.crt /etc/nginx/ssl/
sudo cp new_private.key /etc/nginx/ssl/

# Test the configuration.
sudo nginx -t

# Reload Nginx
sudo systemctl reload nginx

Apache：

# Upload the new certificate
sudo cp new_certificate.crt /etc/apache2/ssl/
sudo cp new_private.key /etc/apache2/ssl/

# Test the configuration.
sudo apache2ctl configtest

# Restart Apache.
sudo systemctl restart apache2

3. Update Certificates on Cloud Services

Alibaba Cloud CDN/SLB:

1. Open the CDN or SLB console.
2. Find the domain you need to update.
3. Upload the new certificate.
4. Activate the new certificate.

Tencent Cloud CDN/CLB:

1. Open the CDN or CLB console.
2. Find the domain you need to update.
3. Upload the new certificate.
4. Activate the new certificate.

5. Prevent Certificate Expiration

1. Configure Expiration Reminders

In CertOne:

1. Enable expiration notifications in the certificate settings.
2. Set an appropriate reminder lead time, such as 30 days where supported.
3. The system sends an email reminder before expiration.

Manual reminders:

• Add calendar reminders.
• Use a task management tool.
• Schedule regular checks.

2. Use automatic renewal

CertOne automatic renewal:

1. Enable automatic renewal in the certificate settings.
2. Set an appropriate renewal lead time, such as 30 days where supported.
3. The system renews the certificate automatically.

acme.sh automatic renewal:

# acme.sh installs a renewal cron job.
# Check for and renew eligible certificates
crontab -l | grep acme.sh

Certbot automatic renewal:

# Certbot packages may install a systemd renewal timer.
# Check for and renew eligible certificates
sudo systemctl list-timers | grep certbot

3. Certificate monitoring

CertOne certificate monitoring:

1. Create a certificate monitoring task.
2. Specify the domain and port to monitor.
3. The system sends reminders before expiration according to the monitoring settings.

Third-party monitoring tools:

• UptimeRobot
• Pingdom
• A custom monitoring script

4. Centralize Certificate Management

Use a certificate management platform:

• Manage certificates centrally in CertOne.
• Record certificate expiration dates
• Configure reminders and automatic renewal consistently.

Maintain a certificate inventory:

• Record the details of every certificate.
• Include domains, expiration dates, and server locations.
• Review and update the inventory regularly.

6. Emergency Response Procedure

1. Identify the Expired Certificate

Immediate actions:

1. Confirm that the certificate has expired.
2. Determine the scope of the impact.
3. Notify the responsible team.

2. Replace the Certificate Promptly

A quick recovery path:

1. Request a replacement certificate in CertOne.
2. Use configured DNS authorization to automate validation.
3. Download the new certificate.
4. Deploy it to the server immediately.

3. Verify the Replacement

Verification steps:

1. Clear the browser cache
2. Visit the website and inspect the served certificate.
3. Run an SSL configuration check.
4. Confirm that affected users can access the service.

7. Common issues

1. The Old Expiration Date Is Still Displayed

Possible causes:

• An existing browser connection is still using the old TLS session.
• A CDN edge or load balancer still serves the old certificate.
• The replacement certificate was not deployed correctly.

Resolution:

• Reconnect or restart the browser and inspect the certificate again.
• Verify certificate deployment on CDN edges and load balancers.
• Check the certificate files used by the server.
• Reload or restart the web server as required.

2. Multiple Servers Share One Certificate

Issue: The renewed certificate must be deployed to multiple servers.

Resolution:

• Use CertOne automatic deployment.
• Configure multiple deployment nodes.
• Deploy after renewal

3. Renewal Fails

Possible causes:

• DNS validation failed.
• HTTP validation failed.
• Validation timed out

Resolution:

• Check DNS records.
• Check the HTTP validation endpoint
• Retry validation
• Contact the certificate provider.

Best practices

1. Certificate management

• ✅ Manage certificates centrally.
• ✅ Set certificate expiration reminders
• ✅ Enable automatic renewal.
• ✅ Check certificate status regularly

2. Automation

• ✅ Automate certificate renewal.
• ✅ Configure automatic deployment.
• ✅ Configure monitoring and alerts.

3. Backups

• ✅ Back up certificates and private keys securely.
• ✅ Document certificate configuration.
• ✅ Establish an incident response procedure.

Conclusion

Certificate expiration is common but often preventable. Reminders, automatic renewal, and monitoring reduce the risk of service disruption.

Key points:

• ✅ Check certificate validity regularly.
• ✅ Set certificate expiration reminders
• ✅ Enable automatic renewal
• ✅ Establish a certificate management process.
• ✅ Prepare an emergency response plan.

CertOne combines certificate renewal, deployment, and monitoring to help keep certificates valid and services accessible.

Automate your certificates with CertOne ↗

Issue free SSL/TLS certificates and automate renewal, deployment, and monitoring with CertOne. Connect your cloud services, servers, and containers from one dashboard.