Expired SSL Certificate: How to Renew and Remove the Warning

When an SSL certificate expires, browsers immediately display a "connection not private" or "your connection is not secure" warning, causing most visitors to leave the site without proceeding. The fix is to renew the certificate as quickly as possible and then enable automatic renewal so it never happens again.

This guide covers the concrete steps to renew an expired SSL certificate in the most common environments: cPanel with AutoSSL, Let's Encrypt on a self-managed server, and paid certificates from a commercial CA.

Why Do SSL Certificates Expire?

SSL certificates have a maximum validity of 398 days (roughly 13 months) since 2020, when browsers stopped trusting longer-lived certificates. This means renewal at least once a year — or every 90 days if you use Let's Encrypt.

The most common reasons a certificate reaches expiry without being renewed:

• Automatic renewal was disabled or failed silently.
• The domain or notification email address changed and renewal alerts were never received.
• The certificate was a paid one and no one managed the renewal in time.
• A server change (new IP, hosting migration) broke the ACME verification process.

How to Identify an Expired SSL Certificate

The most obvious symptom is the browser warning screen. You can confirm it and see the exact expiry date from the command line:

openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates

The notAfter field shows the expiry date. If it has passed, the certificate is expired.

You can also use online tools like SSL Labs (ssllabs.com/ssltest) or WhyNoPadlock for a full visual report.

How to Renew the Certificate in Your Environment

Option 1: cPanel with AutoSSL (Let's Encrypt or Sectigo)

Most cPanel hosting plans include AutoSSL, which renews certificates automatically. If your certificate expired, AutoSSL likely failed for some reason. Follow these steps:

1. Log into cPanel and go to Security > SSL/TLS > Manage SSL Sites.
2. Find the affected domain and click Update Certificate.
3. If the problem persists, go to SSL/TLS > AutoSSL and manually trigger the task with the Run AutoSSL button.
4. Review the AutoSSL log to identify the error (domain not resolving, blocked .well-known folder, etc.).

The most common AutoSSL errors:

• DCV failed: the domain does not point to the server's IP, or a redirect is blocking the validation file.
• Rate limit exceeded: Let's Encrypt limits failed attempts; wait a few hours and retry.
• Wildcard not supported: Sectigo's AutoSSL does not cover wildcard subdomains; you need a separate wildcard certificate.

Option 2: Let's Encrypt on a VPS or Dedicated Server (Certbot)

If you manage your own server, Certbot is the most common ACME client. To renew manually:

certbot renew --dry-run   # Test run without making changes
certbot renew             # Actual renewal

If the certificate has already expired and Certbot is not renewing it automatically, the cron job may be missing. Check for it:

crontab -l | grep certbot
# or on systemd-based systems
systemctl list-timers | grep certbot

If no scheduled task exists, add one:

0 3 * * * certbot renew --quiet --post-hook "systemctl reload httpd"

After renewing, reload the web server so it picks up the new certificate:

systemctl reload httpd    # Apache
systemctl reload nginx    # Nginx

Option 3: Paid Certificate (DigiCert, Comodo, Sectigo, etc.)

Commercial certificates (OV and EV) require a manual renewal with identity verification. The general process:

1. Log into your certificate provider's panel and generate a new CSR (Certificate Signing Request) from your server.
2. Submit the CSR to the provider and complete the validation process (email, DNS, or HTTP file, depending on the type).
3. Download the new certificate files: .crt (certificate) + .ca-bundle (CA chain).
4. Install it on the server from cPanel (SSL/TLS > Install and Manage SSL) or manually in the virtual host configuration.

How to Remove the Browser Warning After Renewing

Once the new certificate is installed, the warning disappears automatically in most browsers on a page reload. A few things to check:

• Browser cache: force a hard reload with Ctrl+Shift+R (or Cmd+Shift+R on Mac).
• Cloudflare or proxy cache: purge the cache from your CDN's dashboard.
• HSTS preload: if your domain is on the HSTS preload list, browsers reject expired certificates more aggressively. The fix is always to renew the certificate — do not disable HSTS.
• Incomplete certificate chain: make sure you include the intermediate CA bundle; without it, some browsers will show warnings even on a valid certificate.

How to Prevent Future Expiry

The best long-term solution is automatic renewal. A quick summary of options:

• cPanel / shared hosting: enable AutoSSL and verify the domain resolves correctly. Set up an email alert in cPanel's notification settings.
• VPS with Certbot: confirm the cron job or systemd timer is active and use the --post-hook flag to reload the web server automatically after renewal.
• External monitoring: tools like UptimeRobot (free) or Better Uptime send alerts when a certificate is less than 30 days from expiry.
• Renewal calendars: for OV/EV certificates with manual processes, schedule the renewal 60 days before the expiry date.

If you manage multiple domains and need ongoing technical support, working with a web hosting agency with SSL management included is the most efficient way to ensure no certificate ever expires unnoticed.

Check out the rest of our guides in the SSL security section to keep your site protected at all times.

Key Takeaways

• An expired SSL certificate triggers browser warnings that drive away visitors and hurt SEO.
• The most common cause is a silent failure in automatic renewal or a server change that breaks the ACME process.
• In cPanel, the quickest fix is to run AutoSSL manually from SSL/TLS > AutoSSL.
• On a VPS with Certbot, verify the cron job exists and add a --post-hook to reload the web server.
• OV/EV certificates require manual renewal at least 60 days before expiry.
• External monitoring with expiry alerts is the ultimate safety net.

Prefer to hand off SSL management entirely? The elenlace.com team handles installation, configuration, and automatic renewal so you never have to worry about it.

FAQ

Can my site still work with an expired SSL certificate?

Technically yes — the site remains online — but modern browsers display a full-screen warning that users must explicitly accept to proceed. The vast majority leave at that point, making it effectively equivalent to a site outage in terms of traffic impact.

How long does a Let's Encrypt renewal take?

The automated Certbot process typically completes in under 60 seconds. DCV (domain control validation) is near-instant when the domain resolves correctly and the server is reachable from the internet.

Does an expired SSL certificate affect Google rankings?

Yes. Google has confirmed HTTPS as a ranking factor. An expired certificate can also prevent Googlebot from crawling the site correctly, degrading your index over time. The longer the certificate stays expired, the greater the negative impact.

What is the difference between renewing and reissuing an SSL certificate?

Renewing extends the validity of a certificate before it expires, keeping the same type and domain. Reissuing generates a new certificate with the same conditions but a new private key — typically because the key was compromised or organizational details need to change. Both processes invalidate the previous certificate.

Further reading

Other providers and guides worth comparing:

• Hostinger
• HubSpot
• IONOS