An expired SSL certificate means the digital ID behind your site's padlock has passed its end date, so browsers show a full-page “Your connection is not private” warning and most visitors leave. It usually happens because automatic renewal failed, a payment lapsed, or your domain's DNS changed. Renewing or reissuing the certificate at your host usually fixes it within minutes to a few hours.
An expired certificate is one of the most visible website problems, because visitors hit a warning before they ever see your homepage. It's also one of the most fixable. Your website content is fine; only the certificate needs replacing.
What does "SSL certificate expired" mean?
An SSL certificate (technically a TLS certificate) is a small digital file that proves your website is really yours. It makes the HTTPS padlock possible and encrypts the connection between your visitors and your site.
Every certificate has a start date and an end date. Once the end date passes, browsers stop trusting it, even if nothing else on your site has changed.
Certificates have to be renewed regularly. Let's Encrypt, the free certificate authority most hosts use, says its default certificates "are valid for 90 days" and recommends renewing them "every 60 days." Paid certificates last longer, but that's changing too, as you'll see below.
Your first step is to confirm the expiry date. Enter your domain in our free SSL checker to see the issuer, the end date and the days remaining.
What do visitors see when a certificate expires?
Instead of your website, visitors see a full-page warning. In Chrome, it reads "Your connection is not private," often with the code NET::ERR_CERT_DATE_INVALID. Safari, Firefox and Edge show similar messages.
Most people leave at this point. Those who stay may be told the site could be trying to steal their information, which isn't a great first impression for a business.
If your site uses HSTS, a setting that tells browsers to always use HTTPS, visitors usually can't click past the warning at all. That's HSTS doing its job, and it means the only fix is a valid certificate.
Contact forms, online booking, checkout and customer logins are effectively offline until the certificate is replaced. Treat it as urgent. The fix is usually quick.
Why did my SSL certificate expire?
Most hosts renew certificates automatically, so an expiry usually means something stopped that process. These are the common causes.
Automatic renewal failed
To renew, the certificate authority checks that you still control the domain, often by fetching a file from your website or reading a DNS record. If your site was down, moved, or blocked that check, renewal quietly fails.
A payment lapsed
Paid certificates and some hosting plans renew only if billing goes through. An expired card or a cancelled plan can stop renewal without much warning.
Your DNS changed
If you moved hosts, switched website builders, or changed where your domain points, the old host can no longer renew the certificate and the new one may not have issued one yet.
A CAA record blocks the issuer
A CAA record is a DNS setting that lists which certificate authorities may issue certificates for your domain. If it doesn't include the authority your host uses, renewal is refused. We explain how to check this below.
The certificate lives somewhere your host doesn't manage
A certificate on a separate server, a subdomain like shop.yourbusiness.com, or a manually installed certificate may not be covered by your host's auto-renewal.
Once you know which cause fits, use the steps for your platform below.
Check your certificate's expiry date now
Our free scan shows whether your certificate is valid, when it expires, and whether HTTPS and your redirect are working.
- Free check
- No signup
- No changes to your website
How do I renew an expired SSL certificate?
Pick the tab for where your website is hosted. If you're not sure, our free website scan detects your platform.
Instructions for cPanel hosting
- 1Log in to cPanel and open SSL/TLS Status.
- 2Select your domain (and the
wwwversion) and click Run AutoSSL. - 3If AutoSSL fails, check that your domain's DNS still points to this host, and look for a CAA record that excludes your host's certificate authority.
- 4If you're still stuck, ask your host's support team to reissue the certificate. It's a routine request.
When you're done, open your site in a private browser window and check the padlock. Then re-run the SSL checker to confirm the new expiry date.
What is a CAA record and can it block renewal?
A CAA record is a DNS setting that names the certificate authorities allowed to issue certificates for your domain. It's defined in RFC 8659 and is a cheap extra safeguard against someone obtaining a certificate for your domain through another authority.
Certificate authorities must check it before issuing. Let's Encrypt explains that "by default, every public CA is allowed to issue certificates for any domain name," and CAA lets you narrow that down. But if your record doesn't list the authority your host uses, renewal fails.
A record that allows Let's Encrypt looks like this:
- TypeCAAName / Host@Value0 issue "letsencrypt.org"Replace letsencrypt.org with your certificate authority if you use a different one.
If you have no CAA records at all, any authority can issue, so CAA isn't your problem. If you do have them, make sure every authority you use is listed. If your domain uses Cloudflare's Universal SSL, Cloudflare's docs say it adds the CAA records it needs automatically when you add your own.
How do I stop my certificate expiring again?
Certificates are getting shorter, so manual renewal is becoming impractical. In 2025 the CA/Browser Forum, the industry group of certificate authorities and browser makers, approved a schedule to cut certificate lifetimes in stages.
That makes automatic renewal plus a second line of defense the sensible approach:
- Use your host's free, auto-renewing certificate where possible
- Turn on auto-renew for any paid certificate
- Keep the payment card on your hosting and certificate accounts up to date
- Check your CAA records include your certificate authority
- After moving hosts or changing DNS, confirm a new certificate was issued
- Put the expiry date in your calendar and check it monthly
Don't rely on reminder emails. Let's Encrypt stopped sending expiration notification emails on June 4, 2025, so a failed renewal can go unnoticed until customers complain.
A quick monthly check with our SSL checker catches problems early. If you'd rather not remember, CyberVigil Monitoring is opening soon. It's designed to re-run your checks every week and email you when something changes, like a certificate nearing expiry. You can join the early-access list on our pricing page.
What should you do next?
- Run the free SSL checker to confirm your certificate's expiry date and issuer.
- Follow the steps for your platform above, then check the padlock in a private browser window.
- If the padlock still shows “Not secure” after renewal, read why a website says not secure to check for mixed content and redirects.
- Run a free website security scan to check your CAA record, HTTPS redirect and security headers in one report.
Common questions
What happens when an SSL certificate expires?
Browsers stop trusting the connection and show a full-page warning such as “Your connection is not private” before anyone reaches your site. Most visitors leave at that point, and forms, checkout and logins effectively stop working for them. Your site's content is untouched; it's the certificate that needs replacing.
How do I check when my SSL certificate expires?
Click the padlock or site information icon in your browser's address bar and open the certificate details, or enter your domain in a free SSL checker. CyberVigil's SSL checker shows the issuer, the expiry date and how many days are left.
Why didn't my SSL certificate renew automatically?
The most common reasons are a lapsed payment or expired card, a domain that no longer points to the host that issues the certificate, a DNS or CAA record that blocks the certificate authority, or a certificate installed somewhere your host doesn't manage, such as a separate server or subdomain.
How long does it take to fix an expired SSL certificate?
If your host issues free certificates automatically, reissuing often takes a few minutes. Paid certificates may need validation, which can take longer. If DNS changes are involved, allow a few hours, and on some website builders up to 48 hours.
Is it safe to visit a site with an expired certificate?
It's best not to enter passwords or payment details while the warning shows, because the browser can't confirm the connection is private. For your own site, fix the certificate rather than asking customers to click past the warning.
Sources
- FAQ (Let's Encrypt)
- Ending Support for Expiration Notification Emails (Let's Encrypt)
- Certification Authority Authorization (CAA) (Let's Encrypt)
- Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods (CA/Browser Forum)
- RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record (IETF)
- Renew my SSL certificate (GoDaddy)
- Universal SSL (Cloudflare)
- Add CAA records (Cloudflare)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.