SSL certificate expired, how to fix your website

If your website’s SSL certificate expired, renew it through the provider that manages HTTPS, then check what visitors receive. Keep the browser’s security checks enabled. Mozilla warns against adding a certificate exception for a public website.

Start with the exact hostname and error. An expired certificate, a wrong hostname, and an untrusted issuer need different fixes. If you need the incident checklist alongside these steps, open the TLS certificate expired playbook.

These steps are for the person responsible for the site. If you are visiting someone else’s website, report the address and error to its owner. Avoid entering payment details or passwords while the warning remains.

1. Record the error before changing settings

Write down the failing URL, the error text, and when it started. Save a screenshot without customer information. Note whether the problem affects your main domain, www, or a separate service such as your API.

In Firefox, SEC_ERROR_EXPIRED_CERTIFICATE means the site’s certificate expired. Other messages can identify a name mismatch, an unknown issuer, or a time problem. Mozilla explains these certificate errors separately.

Check the date and time on the affected device too. If several unrelated sites fail on one computer, include that detail in your investigation. Mozilla’s guidance includes incorrect system time among the causes of certificate errors.

Keep a short incident note: affected hostname, observed error, certificate expiry, recent hosting changes, and who owns renewal. You will need it when asking the hosting provider for help.

2. Find which service presents the certificate

Before requesting another certificate, identify who handles the failing connection. Your hosting platform might manage HTTPS for you. A CDN can also sit between visitors and your server.

Cloudflare calls the visitor-facing certificate an edge certificate. Its Universal SSL troubleshooting guide covers certificate status and hostname coverage. Check the certificate associated with the hostname visitors actually use.

A Cloudflare error 526 points elsewhere: Cloudflare cannot validate the origin server’s certificate while using Full (strict). The origin is the server behind Cloudflare. Renewing a visitor-facing certificate will not repair that origin certificate.

Ask the host to identify the failing certificate if you cannot map the connection yourself. Give them the hostname and error, then ask who issues, installs, and renews that certificate. Keep those responsibilities in the incident note.

3. Repair the failed validation

For a managed hosting service, use its documented certificate recovery process or support route. Avoid installing a second certificate client before you understand the existing setup.

With Let’s Encrypt, issuance requires proof that you control the domain. Its challenge documentation describes the two common paths:

• HTTP-01 serves a validation file under /.well-known/acme-challenge/. Validation uses port 80. Check that the expected file reaches the correct server; multiple frontends must all serve it.
• DNS-01 publishes a TXT value under _acme-challenge. Check the current DNS automation and allow the record to propagate before validation. This method also supports wildcard certificates.

Read the renewal client’s failure message before retrying. Use it to choose which path to inspect. Record the fix so the next renewal uses the repaired configuration.

For DNS automation, keep credentials narrowly scoped. Let’s Encrypt warns that putting full DNS credentials on a web server increases the damage if that server is compromised. Keep credential values out of support tickets and incident notes.

4. Renew and deploy through the existing setup

If this server already uses Certbot, its renewal command reuses the saved configuration. Run it with the privileges required by your installation:

certbot renew

Read the result for the affected certificate. Certbot distinguishes obtaining a certificate from installing it. A setup using certonly needs a separate installation path. Check that your server uses the renewed files and follow its documented reload procedure.

Certbot supports deployment hooks for commands that should run after successful renewal. Review the existing hook if renewal succeeded but the site still serves the old certificate. Avoid adding an untested restart command during the outage.

For error 526, Cloudflare’s checks include expiry, hostname coverage, revocation, and the certificate chain at the origin. Have the hosting operator fix those checks while keeping strict validation enabled.

5. Verify the public site and the next renewal

Open each affected hostname with normal browser security enabled. Check the certificate presented to visitors and confirm that the original error has gone. Include the API or checkout hostname that triggered the incident, rather than stopping at the homepage.

For an existing Certbot installation, test renewal with:

certbot renew --dry-run

Let’s Encrypt recommends staging tests to check issuance before using production. Certbot’s dry run uses that environment. Staging certificates are untrusted by ordinary browsers; keep them out of your production certificate deployment and everyday trust stores.

Record the test result and check the configured renewal schedule. Assign someone to receive failure alerts and someone else who can act when they are away. For infrastructure that recreates servers, Let’s Encrypt recommends durable certificate storage so every new instance does not request fresh issuance.

6. Handle exposed keys as a separate incident

Expiry alone does not establish a hack. An exposed private key or unauthorized certificate issuance needs further response. Let’s Encrypt requires revocation for compromised certificate keys; use your issuer’s recovery process and replace the affected key.

If someone accessed your server or changed DNS without permission, continue with the website hacked playbook. Keep the evidence needed to investigate those changes.

Then open Prepare and work through the TLS preparation safeguards. Assign certificate ownership, document every HTTPS endpoint, and schedule a renewal test with the person who will cover the next outage.

Related playbooks

• TLS certificate expired. Browsers or API clients reject your site because its HTTPS certificate is expired, invalid, or issued for the wrong name.
• Website hacked. An attacker may have altered your site, stolen data, installed persistence, or gained access to connected systems.