SSL certificate expired: how to get your site back quickly

What the browser shows

• Chrome shows “Your connection is not private” with the code NET::ERR_CERT_DATE_INVALID. After you click “Advanced” it says how many days ago the certificate expired, for example: “This server could not prove that it is example.com; its security certificate expired 3 days ago.”, and shows the date set on your computer, asking whether it looks right.
• Firefox shows “Be careful. Something doesn’t look right.” and says that either the site isn’t set up right or your device’s clock is set to the wrong date. After you click “Advanced” it shows the certificate’s expiry date and the date set on your device. Error code: SEC_ERROR_EXPIRED_CERTIFICATE.

Chrome shows the same code when the certificate is fine but the visitor’s device has the wrong date. So start by checking who sees the warning.

Does everyone see the warning, or only you?

• Only one device, while the site works on others: the cause is that device’s clock. We explain how to set it in the guide “Your clock is ahead”.
• Every device with the correct date: the site’s certificate really has expired. You can confirm it in the “Check a certificate” tool, which shows the expiry date and how many days ago it was. If it is someone else’s site, don’t enter any data on it and let the owner know.

Why the certificate expired

• Nobody renewed it. A Let’s Encrypt certificate is valid for 90 days, and Let’s Encrypt has announced that this will be shortened to 64 days from February 10, 2027 and to 45 days from February 16, 2028. Without a reminder, the date is easy to miss.
• Automatic renewal stopped working. The hosting or a program on the server renews the certificate on its own, but something changed: the domain points to another server, a redirect or a firewall blocks the validation, or the hosting service ended.
• There is a new certificate, but the server shows the old one. The certificate was uploaded to another domain in the panel or not assigned to the site, or on your own server the files were replaced without reloading the server.

How to renew the certificate

1. In the “Check a certificate” tool, see which addresses the old certificate was issued for (the “Names in the certificate” row).
2. In the generator, get a new certificate for the same addresses. If the previous freessl.pl certificate is saved in your account, you can choose production mode straight away; otherwise, first do a quick run in test mode.
3. Upload the new certificate to the same place as the previous one, following the guide for your hosting, and check that it is assigned to the domain your site runs on.
4. On your own server, replace fullchain.pem and privkey.pem, test the configuration (sudo nginx -t or sudo apachectl configtest) and reload the server: sudo systemctl reload nginx or sudo systemctl reload apache2 (httpd on AlmaLinux and Rocky Linux). Without a reload, the server keeps showing the old certificate.
5. Check the site again in the tool and in a private window. On a computer with a terminal:

   echo | openssl s_client -connect yourdomain.com:443 \
     -servername yourdomain.com 2>/dev/null \
     | grep "Verify return code"

   An expired certificate gives 10 (certificate has expired), a correct one 0 (ok).

How to keep it from happening again

• Save the certificate in your freessl.pl account. We email you a reminder after two thirds of its validity and a second one a week before it expires, with a link to the guide for your hosting.
• If your hosting or device has built-in automatic Let’s Encrypt renewal (we mention it in the guides, e.g. for QNAP), check now and then that it really works, e.g. in the “Check a certificate” tool.
• How to check the expiry date in every browser is described on the page How to check when a certificate expires.