How to Fix an Expired TLS Certificate

Confirm the certificate is expired

Before renewing, verify which certificate is being served and when it expired. The TLS tool shows expiry dates, the issuer, and the full chain.

From the command line, connect to the server and read the certificate dates:

openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null \
  | openssl x509 -noout -dates

The output shows notBefore and notAfter. If notAfter is in the past, the certificate is expired and needs immediate renewal.

Renew the certificate

The renewal method depends on how your certificate is issued:

• Let's Encrypt (certbot): Run certbot renew. Certbot will renew all certificates that are within 30 days of expiry. If the certificate is already expired, it will renew it immediately.
• CDN or managed hosting (Cloudflare, Netlify, Vercel, etc.): Use the auto-renew or reissue button in your dashboard. These platforms manage certificates automatically; if renewal failed, check the domain is still pointing at the platform.
• CA-issued certificate (DigiCert, Sectigo, etc.): Generate a new Certificate Signing Request (CSR) and submit it to your CA for reissue. The CA will provide a new certificate bundle.

Install the full certificate chain

This is the step most often done incorrectly. Install the leaf certificate and all intermediate certificates in order — not just the leaf.

A chain that ends at the leaf without the intermediates will fail on clients that do not cache intermediates. Most browsers are lenient, but many API clients, mobile apps, and curl will reject an incomplete chain with a certificate verification error.

Your CA or certbot will provide a full-chain file (often named fullchain.pem). Use that file, not the bare certificate file (cert.pem).

In nginx, point ssl_certificate at the full chain file:

ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

Reload the web server

Reload the server configuration to pick up the new certificate. A reload is non-destructive — it does not drop active connections. This is different from a restart.

nginx:

nginx -s reload

Apache:

apachectl graceful

If you are using a process manager like systemd, systemctl reload nginx or systemctl reload apache2 also performs a non-destructive reload.

Verify the new certificate

Run the TLS tool again on your domain. Confirm the new expiry date is in the future, the issuer is correct, and the chain is complete and trusted.

You can also verify with openssl:

openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null \
  | openssl x509 -noout -dates -issuer

Check the browser padlock for the same confirmation. If the browser still shows an expired certificate, clear the browser's certificate cache or test in a private window.

Prevent recurrence: automate renewal and add monitoring

Certificate expiry is entirely preventable with two steps:

• Automate renewal. Certbot installs a cron job or systemd timer by default. Verify it is active: systemctl status certbot.timer. For CDN-managed certificates, ensure auto-renewal is enabled in your dashboard.
• Add expiry monitoring. Configure alerts to notify you when a certificate is within 30 days of expiry. Many uptime monitoring services include TLS expiry checks. The TLS tool shows expiry dates on demand so you can check manually as well.