# SSL certificate expired: what happens and how to recover

> Browsers hard-block expired certificates - every visitor sees a warning, not your site. How to confirm, renew, and never hit this again.

Published: 2026-07-27 | Updated: 2026-08-05 | Canonical: https://yoping.me/guides/ssl-certificate-expired

An expired certificate is a full outage with a healthy server. Browsers
show `NET::ERR_CERT_DATE_INVALID` or "Your connection is not private,"
most users won't click past it (mobile browsers barely let them), and
API clients fail hard with TLS errors. Meanwhile your server logs look
normal, because almost nobody gets far enough to make a request.

## How do I confirm the certificate is actually expired?

Read the dates straight off the live endpoint:

```
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates
```

`notAfter` in the past is your answer. The `-servername` flag matters -
without it you may be reading a different certificate than your visitors
get. Check `www` and the apex separately; they can carry different certs
with different expiry dates, which is how "the site works for me" happens
during a cert outage.

## How do I renew right now?

**Let's Encrypt / ACME setups** - renewal is one command, then a reload:

```
sudo certbot renew --force-renewal
sudo systemctl reload nginx
```

If certbot renews but the site still serves the old cert, the reload
didn't happen or the wrong certificate path is configured - servers load
certificates at startup, not from disk on each request.

**Purchased certificates** - reissue through the CA's portal, install the
new chain, reload. Include intermediates; a missing chain turns "expired"
into "untrusted," which looks identical to users.

**Behind a CDN** - remember there are two certificates: the edge one
(usually auto-managed) and your origin's. If the CDN speaks to your
origin over TLS, an expired origin cert produces 5xx errors at the edge
even while the padlock looks fine.

## Why did nothing warn you?

Auto-renewal fails quietly: a renewal cron that stopped, an ACME
challenge blocked by a firewall rule added months later, a DNS change
that broke validation. The failure sits invisible for the 60-89 days
until expiry.

The fix is watching the certificate itself, from outside. YoPingMe's SSL
check reads your certificate's expiry on every run from both of your
check regions, so a stalled renewal surfaces weeks before the browser
warnings start - on email, webhook, or Slack.
[Ten monitors free](https://app.yoping.me/signup); pair the SSL check with an
[HTTP check](/guides/how-to-check-if-a-website-is-down) on the same
domain and both failure modes are covered.