SSL certificate expired: how to check the expiry date and renew it (free options)

WebsiteScanner · November 3, 2026 · about 7 min read · Tiếng Việt

An SSL certificate (strictly speaking, a TLS certificate) is what lets your site run on https://: traffic is encrypted and the browser can confirm the visitor really reached your domain. After the expiry date the site is still running, but visitors see a red warning page instead of your shop.

Certificate lifetimes keep getting shorter. Let's Encrypt certificates are valid for 90 days. Under the CA/Browser Forum schedule, the maximum validity of publicly trusted certificates drops to 200 days from March 2026 and continues to fall in steps to 47 days by 2029. Renewing by hand, once or twice a year, is turning into renewing every few weeks — automate it.

Signs your certificate has expired

• A full-page browser warning: Chrome says "Your connection is not private" with NET::ERR_CERT_DATE_INVALID; Firefox shows a security risk warning with SEC_ERROR_EXPIRED_CERTIFICATE; Safari says the connection is not private.
• Integrations break: mobile apps, payment gateways and webhooks start failing with certificate errors.
• Customers ask whether your site has been hacked, and traffic or orders drop suddenly.

Note: if a visitor's device clock is wrong, they can see a date error even when the certificate is valid. Check from outside before you conclude anything.

How to check the expiry date

1. In the browser

Click the icon to the left of the address bar, open the connection details and view the certificate. "Valid to" or "Expires on" is the expiry date.

2. With openssl

On any machine with OpenSSL (macOS, Linux, or Git Bash on Windows), replace example.com with your domain:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates

The notAfter= line is the expiry date (in GMT). Keep -servername: on servers that host several domains, leaving it out can return a different domain's certificate. To test whether a certificate expires within the next 14 days (1,209,600 seconds), pipe the certificate into openssl x509 -noout -checkend 1209600; it prints whether the certificate will expire and exits non-zero if so, which is handy in a cron job.

3. With a free checker

The SSL & HTTPS checker reads the certificate the way a browser does and shows the days left, the expiry date and the issuer. It also checks whether the site loads over HTTPS at all, redirects http:// to https://, sends HSTS, and avoids mixed content (images, scripts or CSS loaded over plain http).

Free ways to renew

Hosting with built-in Let's Encrypt

Most hosting panels (cPanel, DirectAdmin, Plesk and others) have a free SSL section, often called AutoSSL or Let's Encrypt. Turn it on once and the host renews it. If it still expires, read the error shown there or ask your provider.

Your own server (VPS): certbot

Certbot is the most common client for Let's Encrypt. On a server running Nginx:

sudo certbot --nginx -d example.com -d www.example.com

For Apache, use --apache instead of --nginx. When installed the official way (snap or your OS packages), certbot sets up a scheduled renewal task (a systemd timer or a cron job). Check that it really works:

sudo certbot renew --dry-run          # test renewal without replacing the real certificate
systemctl list-timers | grep certbot  # or look at /etc/cron.d/certbot if it uses cron
sudo certbot certificates             # list certificates and their expiry dates

Certbot only renews when a certificate is close to expiry (by default around 30 days before, for a 90-day certificate), so running it daily is safe. After renewal the web server must reload to pick up the new file. The --nginx and --apache plugins do this for you; if you used certonly, add a hook such as --deploy-hook "systemctl reload nginx". Other software that serves the certificate (a mail server, a Node app, a load balancer) needs its own reload or restart.

Cloudflare

If your domain is proxied through Cloudflare (orange cloud), Cloudflare issues and renews the certificate between visitors and Cloudflare. The leg from Cloudflare to your server still needs a certificate: choose the Full (strict) SSL mode and install a valid certificate on the server, such as a Cloudflare Origin Certificate (long-lived, trusted only by Cloudflare) or Let's Encrypt. Avoid Flexible, which leaves that leg unencrypted.

Caution: switch to Full (strict) only after the server has a valid certificate for the right hostname. If the origin certificate is missing, expired or for another name, Cloudflare returns error 526 to every visitor straight away.

Why auto-renewal still fails

• DNS changed: the domain now points to a new server or CDN, so validation through the old server fails.
• The validation path is blocked: /.well-known/acme-challenge/ is redirected wrongly or blocked by a security plugin, firewall or .htaccess rule, or port 80 is closed.
• A CAA record in DNS doesn't allow the certificate authority you're using.
• Rate limits: issuing new certificates repeatedly while testing hits Let's Encrypt limits. Use --dry-run or the staging environment.
• Renewed but not reloaded: the web server is still serving the old certificate from memory.
• The scheduled task is gone after a server move or OS upgrade.
• Paid certificates: the invoice wasn't paid, or reminders go to a mailbox nobody reads.
• Missing hostname: the certificate covers example.com but not www.example.com, or the other way round.

If the certificate has already expired

1. Confirm from outside with the openssl command above or from another device.
2. Renew: reissue from your hosting panel, or run sudo certbot renew on a VPS and read any error carefully.
3. Reload or restart the web server, then check both the www and non-www addresses.
4. Find out why auto-renewal failed using the list above and fix it so it doesn't happen again.

Don't find out from your customers

Auto-renewal deserves an independent check. If you turn on email alerts and verify that you own the domain, WebsiteScanner re-scans the site weekly for free and emails you when the SSL certificate has 14 days or less left, or is invalid. WebsiteScanner PRO ($8/month or $80/year by card; 199,000₫/month or 1,990,000₫/year by VietQR) adds a deep scan — 5,000+ checks for known vulnerabilities — and uptime checks every 5 minutes.

Frequently asked questions