Home / Blog / SSL Certificate Expired — How to Check and Fix 2026

SSL Certificate Expired — How to Check and Fix 2026

Diagnose and resolve NET::ERR_CERT_DATE_INVALID warnings before your site loses organic search rankings and user trust.

Published June 05, 2026 · Last updated June 14, 2026 · By Abu Sufyan, Server Security Architect

---

Quick Answer

When an SSL certificate expires, web browsers immediately block access to the site with a severe NET::ERR_CERT_DATE_INVALID warning. To fix this, you must renew or replace the cryptographic certificate on your origin server or Content Delivery Network (CDN). For servers managing their own SSL, running the certbot renew command will automatically provision a new 90-day Let's Encrypt certificate. If you use a managed proxy like Cloudflare, you must ensure your Origin SSL is valid and your Edge encryption mode is configured correctly.

👉 Verify your SSL chain and expiry date instantly using our SSL Certificate Checker Tool → — fully client-side and accurate up to the millisecond.

---

Why This Happens (In-Depth Analysis)

SSL (TLS) certificates do not last forever by design. Security standards set by the CA/Browser Forum require the periodic rotation of cryptographic keys to prevent long-term compromise and ensure outdated, insecure hashing algorithms (like SHA-1) are forcefully retired from the web ecosystem.

It was Black Friday 2023. At 11:45 PM on Thursday, just before midnight sales kicked off, a frantic client called me: "The website is hacked! Nobody can buy anything." I checked the site. It wasn't a hack. The screen showed the dreaded NET::ERR_CERT_DATE_INVALID error. Their legacy paid SSL certificate had quietly expired at 11:30 PM. The internal team thought the billing department had auto-renewed it. They hadn't.

While the billing team was asleep and losing thousands of dollars a minute, I ssh'd into their primary Nginx load balancer, bypassed the old paid certificate provider entirely, installed the ACME client certbot, and provisioned a free Let's Encrypt certificate in 3 minutes. The site came back online 5 minutes before midnight.

This scenario highlights the root cause of 99% of SSL outages: human error in manual renewal processes. Historically, certificates lasted 3 to 5 years. Today, to enforce better cryptographic hygiene, Apple Safari, Google Chrome, and Firefox strictly cap all newly issued SSL certificates to a maximum lifespan of 398 days. Let's Encrypt, which secures the vast majority of the modern web, enforces an even stricter 90-day expiration cycle explicitly to force system administrators to automate their renewals. If your automation script fails, or if a manual reminder is missed, the browser fulfills its core security mandate: it forcefully intercepts the connection, assuming the server has been compromised, and throws a massive red warning screen that scares away 95% of retail traffic.

---

How to Fix It (Step-by-Step Tutorial)

Fixing an expired SSL certificate requires diagnosing where the certificate is generated (the server vs. the CDN) and pushing a valid cryptographic payload.

1. Diagnose the Exact Error Code

Do not just look at the red warning screen; read the specific error code at the bottom of the browser window.

• ERR_CERT_DATE_INVALID: The certificate has mathematically expired. You must renew it.
• ERR_CERT_AUTHORITY_INVALID: The certificate was self-signed or the issuer is not trusted. You must install a certificate from a trusted Certificate Authority (CA).
• ERR_CERT_COMMON_NAME_INVALID: The certificate does not match the domain (e.g., the cert is valid for site.com but you visited www.site.com). You must issue a new cert that covers the exact Subject Alternative Names (SANs).

2. Renew Let's Encrypt Certificates (Ubuntu / Nginx / Apache)

If you manage your own Virtual Private Server (VPS), you likely use Certbot. To manually force a renewal for an expired certificate, connect via SSH and execute:

# Force renewal of the certificate
sudo certbot renew --force-renewal

# Reload the web server to ingest the new certificate keys
sudo systemctl reload nginx
# or
sudo systemctl reload apache2

Crucial Automation: You should never run this manually. Set up a cron job to run it automatically.

# Open crontab editor
sudo crontab -e

# Add this to crontab to run the checker every night at 3 AM. 
# Certbot will only actually renew certificates within 30 days of expiry.
0 3 * * * /usr/bin/certbot renew --quiet --post-hook "systemctl reload nginx"

3. Resolve Cloudflare SSL (Error 526)

If you are using Cloudflare, SSL is handled at the Edge. If your site throws a 526 Invalid SSL certificate error, it means the connection between the user and Cloudflare is secure, but the connection between Cloudflare and your origin server is broken because your origin server's SSL expired.

1. Log into Cloudflare and navigate to SSL/TLS -> Overview.
2. If your SSL mode is Full (Strict), Cloudflare strictly verifies the origin certificate.
3. The Fix: Navigate to Origin Server, click "Create Certificate", generate a free 15-year Origin Certificate, and install the resulting PEM and KEY files directly onto your Apache/Nginx server. Because Cloudflare proxies the traffic, the public internet never sees this 15-year certificate, satisfying modern browser limits while saving you from renewal headaches.

Faster way: use the SSL/TLS Certificate Checker

Before running commands blindly, you need to understand the exact state of your cryptographic chain.

Open the SSL/TLS Certificate Checker — Free, No Signup →

Instead of using command-line OpenSSL tools, paste your domain into our checker. It will instantly audit your certificate chain, display the exact expiration date down to the second, verify the issuing Authority, and check if you are properly enforcing modern TLS 1.2 and 1.3 protocols.

---

Edge Cases Most Guides Miss

The Mixed Content Trap (Padlock Missing): Sometimes, you successfully renew your SSL certificate, the ERR_CERT_DATE_INVALID error disappears, but the browser still says "Not Secure" and removes the padlock icon. This is caused by Mixed Content.

If your secure HTTPS page explicitly loads an image, script, or stylesheet over an unencrypted http:// URL, the browser flags the entire page as compromised. Attackers can hijack the unencrypted HTTP image request to inject malicious payloads into the secure page. To fix this, you must enforce a Content Security Policy (CSP) header: Upgrade-Insecure-Requests. This forces the browser to silently rewrite all http:// asset requests to https:// before they are executed.

Certbot Rate Limits: During a crisis, junior engineers often panic and run the certbot --nginx generation command over and over again while trying to fix routing bugs. Let's Encrypt enforces strict rate limits (typically 5 duplicate certificates per week). If you hit this limit, you are locked out, and your site will remain offline for a week. Always append the --dry-run flag to your certbot commands when testing configurations to bypass production rate limits.

---

Comprehensive FAQ

What happens to SEO when an SSL certificate expires?

Google officially uses HTTPS as a ranking signal. If Googlebot encounters an expired SSL certificate, it treats the site as technically unavailable. Prolonged downtime will result in your pages being de-indexed from the Search Engine Results Pages (SERPs) until a valid cryptographic handshake is restored.

Is a free Let's Encrypt SSL good enough for enterprise?

Yes. Let's Encrypt provides domain-validated (DV) certificates using the exact same 256-bit encryption algorithms as paid certificates. Unless you are a financial institution requiring Extended Validation (EV) certificates for regulatory compliance or massive wildcard warranties, Let's Encrypt is the modern industry standard.

Why did my Let's Encrypt auto-renewal fail?

The most common reason a cron-based certbot auto-renewal fails is that port 80 (HTTP) was blocked by a firewall. The ACME protocol verifies domain ownership by placing a challenge file on your server and accessing it via http://YOUR-DOMAIN/.well-known/acme-challenge/. If your firewall blocks port 80, the verification fails, and the certificate will not renew.

Does a CDN replace the need for an SSL certificate on my server?

No. While a CDN (like Cloudflare or Fastly) provides an SSL certificate to your end-users (Edge Encryption), the traffic flowing from the CDN back to your origin server will be unencrypted and vulnerable to interception unless you also install a valid SSL certificate on your actual server (Origin Encryption).

---

About the Author

Abu Sufyan — Server Security Architect and Founder of WebToolkit Pro. Specializing in cryptographic deployments, high-availability load balancing, and automated DevSecOps pipelines. GitHub · Portfolio

---

Related tools:

• Password Entropy Tester — Calculate the exact bit-strength and cracking time of cryptographic passphrases.
• Redirect Checker — Audit your HTTP to HTTPS redirect chains after installing a new certificate.

---

{
  "@context": "https://schema.org",
  "@type": "Article",
  "headline": "SSL Certificate Expired — How to Check and Fix 2026",
  "description": "Check if your SSL certificate is expired and fix it before Google flags your site as insecure. Covers Let's Encrypt renewal, Cloudflare SSL, and common errors.",
  "datePublished": "2026-06-05",
  "dateModified": "2026-06-14",
  "author": {
    "@type": "Person",
    "name": "Abu Sufyan",
    "url": "https://github.com/abusufyan-netizen"
  },
  "publisher": {
    "@type": "Organization",
    "name": "WebToolkit Pro",
    "url": "https://wtkpro.site"
  },
  "mainEntityOfPage": {
    "@type": "WebPage",
    "@id": "https://wtkpro.site/blog/ssl-certificate-expired-check-fix/"
  }
}

{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "What happens to SEO when an SSL certificate expires?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Google officially uses HTTPS as a ranking signal. If Googlebot encounters an expired SSL certificate, it treats the site as technically unavailable. Prolonged downtime will result in your pages being de-indexed from the SERPs until a valid cryptographic handshake is restored."
      }
    },
    {
      "@type": "Question",
      "name": "Is a free Let's Encrypt SSL good enough for enterprise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes. Let's Encrypt provides domain-validated (DV) certificates using the exact same 256-bit encryption algorithms as paid certificates. Unless you are a financial institution requiring Extended Validation (EV) certificates for regulatory compliance, Let's Encrypt is the modern industry standard."
      }
    },
    {
      "@type": "Question",
      "name": "Why did my Let's Encrypt auto-renewal fail?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The most common reason a cron-based certbot auto-renewal fails is that port 80 (HTTP) was blocked by a firewall. The ACME protocol verifies domain ownership via HTTP. If your firewall blocks port 80, the verification fails, and the certificate will not renew."
      }
    },
    {
      "@type": "Question",
      "name": "Does a CDN replace the need for an SSL certificate on my server?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. While a CDN provides an SSL certificate to your end-users, the traffic flowing from the CDN back to your origin server will be unencrypted and vulnerable to interception unless you also install a valid SSL certificate on your actual origin server."
      }
    }
  ]
}