How to renew an expired SSL certificate
When you need to renew an expired SSL certificate, the certificate has already passed its notAfter date and every visitor sees a hard block. Renewing has two parts that people often split by accident: issue the new certificate, and reload the server so it actually serves the new file. Doing only the first leaves the site broken.
- Likely cause
- The certificate expired and a new one must be issued and loaded
- Severity
- High — the site is down for everyone until reloaded
- Time to fix
- About 10 minutes
- Prevention
- Automated renewal plus outside expiry monitoring
What causes it
- Automated renewal was never set up, so the certificate ran out.
- Renewal ran but the reload hook failed, so the server kept serving the old file.
- Renewal is blocked by a rate limit or a failing domain-control check.
How to fix it
1. Issue the new certificate
Run your ACME client to obtain a fresh certificate. For a certbot setup, renew all due certificates.
sudo certbot renew --force-renewal2. Reload the server so it serves the new file
The new certificate does nothing until the web server reloads. This is the step most often missed.
sudo systemctl reload nginx3. Verify the live host, not the file
Confirm the served certificate now has a future expiry, checking the live host rather than the file on disk.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -enddate
How to prevent it
Set renewal to run automatically, confirm the reload hook actually fires, and monitor the served certificate’s expiry from outside so a stalled renewal reaches you days ahead rather than as an outage.
Source: Certbot user guide
Common questions
I ran renew but the site is still expired. Why?
The server is still holding the old certificate. Reload or restart it after renewal, then verify the live host rather than the file on disk.
Can I renew before the certificate expires?
Yes, and you should. ACME clients renew within a window before expiry so a failure has time to retry. Waiting until the day of expiry leaves no margin.
Fixed it? Catch the next one before your visitors do — monitor the certificate from outside, 3 free, no card.