"SSL certificate expiring soon" means your website's certificate has fewer than 21 days left. It still works, but Let's Encrypt's 90-day certificates are meant to renew with about 30 days to spare, so this often means automatic renewal has stalled. Check who manages your certificate, confirm auto-renew is on, fix any DNS or billing problem, and re-check.
If your CyberVigil report says your SSL certificate is expiring soon, your site is still working. You have time to make sure the certificate renews before visitors see a warning, and most fixes take 15 to 20 minutes.
Check your certificate below and note the expiry date and the issuer. You'll use both in the steps that follow.
What does "SSL certificate expiring soon" mean?
Your SSL certificate proves your website is really yours and makes the HTTPS padlock possible. Every certificate has an end date, and a new one has to replace it before then.
We show "Expiring soon" when your certificate has 8 to 20 days left. At 7 days or fewer, we raise it to "Needs attention," and once the date passes, it shows as "Expired."
We warn at that point because free certificates usually renew well before it. Let's Encrypt, which many hosts use, recommends renewing its 90-day certificates every 60 days, so the old certificate still has about 30 days left when the new one arrives. A certificate with less than three weeks left often means renewal didn't run on schedule.
There's one exception. Some certificates are short-lived on purpose. Let's Encrypt offers six-day certificates, and lifetimes across the industry are shrinking. If your certificate was issued recently and only lasts a few weeks, the warning may just reflect its short life. Click the padlock in your browser and open the certificate details to see when it was issued.
Why hasn't my certificate renewed yet?
Most hosts renew automatically, so a certificate this close to its end date usually means something is in the way. The causes are the same ones behind an expired certificate, caught earlier:
- Your domain's DNS changed. If you moved hosts or switched builders, the old host can't renew and the new one may not have issued a certificate yet.
- A payment lapsed on a paid certificate or hosting plan.
- The renewal check couldn't reach your site. Certificate authorities confirm you still control the domain, often by fetching a file from your website or reading a DNS record, and a firewall, redirect rule or outage can block that.
- A CAA record doesn't list your host's certificate authority. Our CAA guide explains how to check.
- The certificate sits on a server or subdomain that your host's auto-renewal doesn't cover.
How do I make sure my certificate renews?
Step 1: Find who manages your certificate
Look at the issuer in the checker and think about where your site is hosted. Website builders and Cloudflare manage certificates for you. On shared hosting, it's usually cPanel's AutoSSL or your host's SSL page. If someone installed a certificate on your own server, it renews only if they set up automation.
Step 2: Check renewal for your platform
Instructions for cPanel hosting
- 1Log in to cPanel and open SSL/TLS Status.
- 2Filter the list by Expiring Soon or Has AutoSSL Problems. The Certificate Status column shows any AutoSSL error for each domain.
- 3Fix the problem it lists, such as a domain that no longer points to this host, then select your domain and click Run AutoSSL.
- 4If AutoSSL keeps failing, ask your host's support team to check the AutoSSL logs.
Step 3: Renew now if you need to
If something was blocking renewal, renew as soon as you've fixed it rather than waiting for the next automatic attempt. Then re-run the SSL checker. The new certificate shows a later expiry date, and the warning clears on your next scan.
Check your certificate and the rest of your site
Run a free scan to see your certificate, HTTPS redirect, CAA record and security headers in one plain-English report.
- Free check
- No signup
- No changes to your website
Why are certificate lifetimes getting shorter?
In 2025, the CA/Browser Forum approved a schedule that cuts the maximum lifetime of public certificates from 398 days to 47 days, in steps between March 2026 and March 2029. Let's Encrypt is shortening its default certificates as well, from 90 days to 64 days in February 2027 and to 45 days in February 2028.
That makes manual renewal impractical. Let's Encrypt says renewing on a fixed 60-day schedule "will no longer be sufficient" for 45-day certificates and suggests renewing about two thirds of the way through each certificate's life. If your setup depends on someone remembering, switch to your host's automatic certificates now.
Don't count on reminder emails either. Let's Encrypt stopped sending expiration notification emails on June 4, 2025, so a stalled renewal can go unnoticed until visitors see a warning.
What should you do next?
- Check your certificate with the free SSL checker and write down the expiry date.
- Follow the steps for your platform, renew if needed, and confirm the new date.
- Put the next expiry date in your calendar and check it monthly.
- If the date passes before you've fixed it, follow our guide to an expired SSL certificate.
- CyberVigil Monitoring, opening soon, is designed to re-check your site and email you when something changes. You can join the early-access list on our pricing page.
Common questions
Is my website broken right now?
No. The certificate is still valid, so visitors see the padlock as normal. The warning gives you time to fix renewal before the expiry date, which is when browsers start showing a full-page warning instead of your site.
My host says certificates renew automatically. Why the warning?
Automatic renewal can fail quietly, often because DNS changed, a payment lapsed or the renewal check couldn't reach your site. It can also be normal for a certificate that's short-lived by design. If yours was issued recently and lasts only a few weeks, renewal is probably working.
How early do certificates usually renew?
It depends on the provider. Let's Encrypt recommends renewing its 90-day certificates every 60 days, which leaves about 30 days. GoDaddy renews auto-renewing paid certificates 60 days before they expire.
Can I renew my certificate early?
Usually, yes. Free certificates from your host can typically be reissued whenever you need, for example with Run AutoSSL in cPanel. For a paid certificate, check your provider's renewal page, since renewing can involve checkout and verification.
Why are certificates getting shorter?
In 2025 the CA/Browser Forum, the group of certificate authorities and browser makers, approved cutting the maximum lifetime of public certificates from 398 days to 47 days in steps between March 2026 and March 2029. Let's Encrypt is shortening its defaults too.
Will Let's Encrypt email me before my certificate expires?
No. Let's Encrypt stopped sending expiration notification emails on June 4, 2025. Check the date yourself with the SSL checker, or use a monitoring service that alerts you.
Sources
- FAQ (Let's Encrypt)
- Decreasing Certificate Lifetimes to 45 Days (Let's Encrypt)
- Ending Support for Expiration Notification Emails (Let's Encrypt)
- Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods (CA/Browser Forum)
- SSL/TLS Status (cPanel & WHM Documentation)
- Universal SSL (Cloudflare Docs)
- Renew my SSL certificate (GoDaddy Help)
- Troubleshooting Your SSL Certificate (Wix Help Center)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.