SSL certificate expired: what happens and how to recover

An expired certificate is a full outage with a healthy server. Browsers show NET::ERR_CERT_DATE_INVALID or “Your connection is not private,” most users won’t click past it (mobile browsers barely let them), and API clients fail hard with TLS errors. Meanwhile your server logs look normal, because almost nobody gets far enough to make a request.

How do I confirm the certificate is actually expired?

Read the dates straight off the live endpoint:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

notAfter in the past is your answer. The -servername flag matters — without it you may be reading a different certificate than your visitors get. Check www and the apex separately; they can carry different certs with different expiry dates, which is how “the site works for me” happens during a cert outage.

How do I renew right now?

Let’s Encrypt / ACME setups — renewal is one command, then a reload:

sudo certbot renew --force-renewal
sudo systemctl reload nginx

If certbot renews but the site still serves the old cert, the reload didn’t happen or the wrong certificate path is configured — servers load certificates at startup, not from disk on each request.

Purchased certificates — reissue through the CA’s portal, install the new chain, reload. Include intermediates; a missing chain turns “expired” into “untrusted,” which looks identical to users.

Behind a CDN — remember there are two certificates: the edge one (usually auto-managed) and your origin’s. If the CDN speaks to your origin over TLS, an expired origin cert produces 5xx errors at the edge even while the padlock looks fine.

Why did nothing warn you?

Auto-renewal fails quietly: a renewal cron that stopped, an ACME challenge blocked by a firewall rule added months later, a DNS change that broke validation. The failure sits invisible for the 60–89 days until expiry.

The fix is watching the certificate itself, from outside. YoPingMe’s SSL check reads your certificate’s expiry on every run from Frankfurt, Virginia, and Singapore, so a stalled renewal surfaces weeks before the browser warnings start — on email, webhook, or Slack. Ten monitors free; pair the SSL check with an HTTP check on the same domain and both failure modes are covered.