An expired SSL certificate means the certificate that proves your website's identity has passed its expiry date, so browsers stop trusting it on the spot. Visitors see a full-screen warning such as NET::ERR_CERT_DATE_INVALID instead of your content, API clients and mobile apps fail outright, and traffic collapses until the certificate is replaced. The fix is to renew or reissue the certificate, install the new full chain on every server that terminates TLS, and reload those services; with an automated ACME setup that takes minutes. This guide shows you how to check your expiry date, fix an expired certificate step by step, and make sure it never happens again.
What visitors see when your SSL certificate expires
Browsers do not politely mention the problem in a corner. They replace your entire page with a warning screen, and the visitor has to dig through an "Advanced" menu to proceed at all. The wording differs by browser:
| Browser | Warning screen | Error code |
|---|---|---|
| Chrome | "Your connection is not private" | NET::ERR_CERT_DATE_INVALID |
| Edge | "Your connection isn't private" | NET::ERR_CERT_DATE_INVALID |
| Firefox | "Warning: Potential Security Risk Ahead" | SEC_ERROR_EXPIRED_CERTIFICATE |
| Safari | "This Connection Is Not Private" | Shown without a code on the first screen |
These warnings are common enough to be measured at scale. In the largest published study of browser certificate warnings, Google and Carnegie Mellon researchers analysed more than 300 million Chrome warning reports and attributed 4.23% of warnings on Windows to certificate date errors (Acer et al., ACM CCS 2017). Expired certificates are the routine failure mode of HTTPS, and the warning screen itself is often the first sign an owner gets.
More than your homepage breaks
The browser warning is only the visible part. The quiet failures usually cost more:
- APIs and webhooks fail hard. Machine clients do not have an "Advanced" button. Payment callbacks, mobile apps, partner integrations and monitoring agents simply refuse the connection the second the certificate expires.
- HSTS removes the escape hatch. If your site sends the HSTS header, browsers hide the "proceed anyway" link entirely. Visitors cannot click through even if they want to.
- Email and internal tools stop. TLS on SMTP, IMAP and admin panels fails just as hard, and those certificates are the ones nobody watches.
- Trust erodes fastest. A business with an expired certificate on its own site is a contradiction visitors remember. Search engines also see the warning state, and conversion-focused pages lose their traffic for as long as the warning stands.
Three famous outages caused by one expired certificate
Certificate expiry is not a small-company problem. Some of the most expensive outages of the past decade were caused by exactly this:
| Date | Company | What expired | Impact |
|---|---|---|---|
| 6 Dec 2018 | Ericsson (O2, SoftBank) | Certificate in core mobile network software | About 32 million O2 subscribers in the UK lost data for most of the day; tens of millions of SoftBank customers in Japan were cut off for hours (The Register) |
| 3 Feb 2020 | Microsoft Teams | Authentication certificate | Roughly three hours of global downtime for a service with 20 million daily users (TechCrunch) |
| 19 Aug 2020 | Spotify | Wildcard TLS certificate (*.wg.spotify.com) | Around one hour of global outage across players and APIs (Data Center Dynamics) |
The lesson is uncomfortable: these companies employ world-class engineers, and the certificate still expired. Renewal is a process problem, not a skill problem, and a calendar reminder in someone's inbox is not a process.
How to check when your certificate expires
Three ways, from quickest to most thorough:
1. In the browser. Click the padlock or tune icon in the address bar, open "Connection is secure", then "Certificate is valid". The details panel shows the exact validity period.
2. From the command line. Query the live certificate with OpenSSL:
openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates
The output prints notBefore and notAfter; the second line is your deadline.
3. Check the whole chain, not just your own certificate. Intermediate and root certificates expire too. When the AddTrust External CA Root expired on 30 May 2020, services with perfectly valid leaf certificates failed worldwide, including Roku devices and several payment platforms. An external scan that validates the full chain catches what a glance at your own certificate misses.
How to fix an expired SSL certificate, step by step
Step 1: confirm expiry is really the cause. Run the OpenSSL command above and read notAfter. If the certificate is actually valid, the visitor's device clock is wrong, and nothing on your server needs fixing.
Step 2: renew or reissue. With Let's Encrypt or any other ACME client the renewal is one command (sudo certbot renew), and a dry run (sudo certbot renew --dry-run) tells you in advance whether validation will succeed. With a commercial CA, generate a fresh CSR in your control panel and complete validation there.
Step 3: install the full chain everywhere TLS terminates. The new certificate has to reach every endpoint that speaks TLS for the domain: origin servers, load balancers and the CDN edge. Deploy fullchain.pem (leaf plus intermediates), not the leaf alone, or you trade a date error for a chain error.
Step 4: reload the service. A renewed file on disk changes nothing until the server re-reads it. Run sudo systemctl reload nginx (or the equivalent for Apache, HAProxy or your platform). This is the single most common failure in "automated" setups: the renewal cron works perfectly, the reload hook was never configured, and the server keeps serving the old certificate from memory.
Step 5: verify from the outside. Check from a phone on mobile data, a fresh browser profile, or an external scanner. There is no propagation delay with certificates: the moment the server is reloaded, every new connection receives the new certificate.
Renewal is about to get relentless
If renewal feels manageable today, the schedule is changing under your feet. Under CA/Browser Forum ballot SC-081v3, adopted in April 2025 by a unanimous 29-0 vote, the maximum lifetime of a public TLS certificate dropped from 398 to 200 days on 15 March 2026, falls to 100 days on 15 March 2027, and lands at 47 days on 15 March 2029 (CA/Browser Forum). Let's Encrypt has gone further already: it announced in December 2025 that its default lifetime will drop from 90 to 45 days, and its six-day short-lived certificates became generally available on 15 January 2026.
Certificate lifetimes available and permitted in 2026. Sources: CA/Browser Forum ballot SC-081v3; Let's Encrypt.
The direction is one-way: renewals that used to happen once a year will soon happen every six to seven weeks, and for short-lived certificates every few days. Manual renewal does not survive that schedule. Automation stops being a nice-to-have and becomes the only way to keep a certificate valid.
How to never let a certificate expire again
- Automate issuance and renewal with ACME, and configure the deploy hook that reloads your web server after each renewal.
- Monitor expiry from outside. An external check catches every certificate a renewal script silently skipped. Alert at 30, 14 and 7 days before expiry.
- Inventory every certificate, not just the main site: API subdomains, mail servers, staging hosts and internal panels expire on their own schedules.
- Treat renewal as a deployment. It changes what production serves, so it deserves the same verification step as a code release.
Related guides
- SSL/TLS certificate security: the complete guide to an A+ rating covers protocols, chains and configuration beyond expiry.
- "Your connection is not private": what it means and how to fix it explains the warning screen your visitors are seeing right now.
- ERR_CERT_AUTHORITY_INVALID: what causes it and how to fix it handles the chain errors that often appear right after a rushed renewal.
- What is HSTS? explains why some visitors cannot bypass certificate warnings at all.
FAQ
Can visitors still open my site while the certificate is expired?
In most browsers they can click through an "Advanced" menu, but the majority will not, and if your site sends HSTS the browser removes that option entirely. API clients and apps refuse the connection outright.
Does an expired SSL certificate hurt SEO?
Indirectly, yes. Crawlers see the same invalid certificate, visitors bounce off the warning page, and HTTPS is a confirmed ranking signal. The longer the warning stands, the more traffic and trust you lose.
How long does the fix take?
With ACME automation in place, minutes: renew, reload, verify. There is no propagation period, because the new certificate is served to every new connection immediately after the reload.
Why did my certificate expire even though auto-renewal was on?
The usual causes: the renewal ran but no reload hook was configured, so the old certificate stayed in memory; validation silently failed after a DNS or firewall change; or the renewal covered one hostname but not the certificate that actually expired.
Do expired certificates on internal tools matter?
Yes. Internal and API certificates fail the same way public ones do, and they are watched less. Many of the incidents in this article started with a certificate nobody had inventoried.
Check your certificates before your visitors do
An expiry date never negotiates. Run a free FortifyNet scan to see your certificate's exact expiry date, the full chain, protocol configuration, security headers, DNS and email authentication in about 60 seconds. No signup required.
Sources: CA/Browser Forum, Ballot SC-081v3; Let's Encrypt, Certificate Lifetimes; Let's Encrypt, 6-day certificates GA; The Register on the Ericsson outage; TechCrunch on the Teams outage; Data Center Dynamics on the Spotify outage; Acer et al., "Where the Wild Warnings Are", ACM CCS 2017.
Originally published at fortifynet.com/blog/ssl-certificate-expired. I'm the founder of FortifyNet, a website security scanner; this article comes from our blog, so factor in that founder bias when you read any tool recommendations here.
Top comments (0)