What Happens When an SSL Certificate Expires
An expired SSL certificate puts up a full-page browser warning that blocks most visitors, so here is exactly what happens and the fastest way to fix it.
If you are reading this because a site just went down, go straight to the fix section below. You can read the rest later.
An expired SSL certificate does not just add a warning badge to your site. Browsers replace your entire site with a security wall, and most visitors will not click past it. For practical purposes, the site is offline until the certificate is renewed.
What visitors see
The exact warning depends on the browser, but all of them are full-page and alarming by design.
- Chrome shows "Your connection is not private" and reports the error code
NET::ERR_CERT_DATE_INVALID. The address bar displays a red "Not secure" label. - Firefox shows "Warning: Potential Security Risk Ahead" and hides the page content by default.
- Safari shows "This Connection Is Not Private" and refuses to load the site.
Each browser gives visitors an option to proceed anyway, buried behind a click or two. In practice, certificate monitoring research suggests more than 85% of visitors leave rather than bypass the warning. If the site is an online store or a booking page, nearly all traffic from new visitors stops until the certificate is fixed.
When there is no bypass at all
Most sites with an expired certificate at least let determined visitors click through. Some do not.
If the site sends an HTTP Strict Transport Security (HSTS) header, browsers enforce HTTPS absolutely. When the certificate expires on an HSTS-enabled site, the browser will not fall back to HTTP and will not show a "proceed anyway" option. The visitor sees the error and that is the end. There is no workaround from the browser side.
This is intentional. HSTS exists to prevent man-in-the-middle attacks. The side effect is that when the certificate lapses on an HSTS-enabled site, every visitor is blocked, not just the cautious ones.
You can check whether HSTS is active by inspecting the site's response headers for a Strict-Transport-Security line.
How to fix it fast
The path depends on how the certificate was issued.
Let's Encrypt / Certbot
Let's Encrypt certificates are valid for 90 days and are typically renewed automatically by Certbot. If auto-renewal broke or was never set up, you can renew manually:
sudo certbot renew --force-renewal
This takes less than a minute on most servers. Once the command finishes, reload your web server:
For nginx:
sudo systemctl reload nginx
For Apache:
sudo systemctl reload apache2
The site should be back immediately. If Certbot fails, check that port 80 is open. Domain validation requires an inbound HTTP connection.
Hosting control panel
Most managed hosts have a one-click SSL renewal option in the control panel, typically under SSL/TLS or Security. Log in, find the expired certificate, and click renew. Some hosts auto-renew by default, and this step is just confirming the process ran.
If the host issues certificates through Let's Encrypt automatically, you can also trigger a re-issue by removing and re-adding the certificate from the panel.
Paid certificate from a certificate authority
If the certificate was purchased from a commercial CA like DigiCert or Sectigo, you need to:
- Generate a new Certificate Signing Request (CSR) from your server or hosting panel.
- Submit the CSR to the CA and complete domain validation, typically by responding to a verification email or placing a file at a known path on the domain.
- Download the new certificate files and install them.
Domain validation typically completes within minutes once you act on the CA's email. The total time from starting to a live certificate is usually under 30 minutes.
What else breaks when a certificate expires
Visitors getting blocked is the most visible consequence, but not the only one.
APIs and automated services that call your site over HTTPS will also fail. Depending on how strict the client is, you may see broken webhooks, failed payment callbacks, or third-party integrations going silent. If the expired certificate is on a mail server, encrypted SMTP connections may fail, causing email delivery problems.
These failures often produce no obvious error messages on your end. A webhook stops firing, nobody notices, and the problem only surfaces when someone audits the logs weeks later.
How to make sure it never happens again
The fix above gets the site back. The goal after that is to make expiry a non-event.
Auto-renewal
If the certificate is from Let's Encrypt, Certbot sets up a cron job or systemd timer that checks for upcoming expiries twice a day and renews when a certificate is within 30 days of expiry. Verify it is working:
sudo certbot renew --dry-run
If the test fails, fix the renewal job now rather than the next time a certificate quietly lapses. Note that Let's Encrypt is moving toward shorter certificate lifetimes in coming years, which makes reliable automation even more important.
Certificate monitoring
Auto-renewal can break silently. The renewal job runs, domain validation fails because a DNS record changed, and the certificate expires anyway. A monitoring tool that sends you warnings at 14, 7, 3 and 1 day before expiry gives you enough time to catch a broken renewal before it becomes an incident.
This matters especially for sites you manage for clients. You may not have direct access to the server logs, and you will not see a failed renewal unless something is actively checking certificate dates for you. Setting up that kind of monitoring across all your client sites is covered in detail in how to monitor your clients' websites.
Keep a record
The hardest certificates to track are the ones that were issued once and forgotten: a certificate on a subdomain, a mail server, or a staging environment. Keep a record of every certificate across every domain you manage, with expiry dates. A monitoring service that checks all your sites automatically removes the need to maintain that list by hand.
What an expired certificate actually costs
For any site handling real traffic, an expired certificate during peak hours is expensive. With most visitors refusing to proceed past the warning, traffic that would have converted disappears. The lost revenue is immediate.
For a client site, the cost also falls on you. You built the site, and the client expects you to know about problems before they do. An expired certificate that the client discovers because their phone shows a warning is the kind of incident that ends working relationships, even when the fix itself takes only minutes.
Trrack.it monitors SSL certificate expiry on all your client sites and sends you alerts at 14, 7, 3 and 1 day before a certificate lapses, so you always have time to act before anyone notices. Your first site is free, so you can get started in a couple of minutes.