SSL Certificate Expired: How to Fix It (Nginx, Apache, Let's Encrypt)

Your site suddenly shows 'Your connection is not private' in Chrome, and Firefox refuses to connect at all. Your SSL certificate expired. Every visitor sees a scary red warning, Google stops crawling, and conversions crater. Good news: fixing it usually takes under 5 minutes. Here's exactly how.

Table of Contents

• What actually happens when SSL expires
• Step 1 — Confirm the expiry
• Step 2 — Renew Let's Encrypt with Certbot
• Step 3 — Renew a paid certificate
• Step 4 — Reload Nginx
• Step 5 — Reload Apache
• Step 6 — Verify the new cert
• Clearing Chrome and Firefox warnings
• Preventing future expiries (automation)
• Troubleshooting renewal failures
• Security best practices
• FAQ

What Actually Happens When SSL Expires

Every SSL certificate has a notAfter date. When that date passes, browsers reject the certificate because they can't be sure the private key hasn't been rotated or compromised. Chrome shows NET::ERR_CERT_DATE_INVALID; Firefox shows SEC_ERROR_EXPIRED_CERTIFICATE.

If your site sent HSTS headers, browsers refuse to let visitors 'proceed anyway' — the site is completely inaccessible until you fix it.

Step 1 — Confirm the Expiry

Use an SSL Checker tool or run from the command line: echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates. It prints notBefore and notAfter. If notAfter is in the past, you're expired.

Step 2 — Renew Let's Encrypt with Certbot

1. SSH into the server.
2. Run: sudo certbot renew --dry-run to confirm renewal would succeed.
3. If dry-run is clean, run: sudo certbot renew
4. For an immediate renewal (before the 30-day window): sudo certbot renew --force-renewal

Certbot writes the new cert to /etc/letsencrypt/live/yourdomain/. Your Nginx/Apache config already points there, so no path changes are needed.

Step 3 — Renew a Paid Certificate

Log into your certificate authority's dashboard (DigiCert, Sectigo, GoDaddy), generate a new CSR on your server, paste it into the renewal form, complete domain validation (email, DNS or HTTP file), and download the new cert bundle. Replace the old .crt and intermediate .ca-bundle files on your server.

Step 4 — Reload Nginx

The new cert file is on disk but Nginx is still serving the old cert from memory. Reload gracefully: sudo nginx -t (test config), then sudo systemctl reload nginx. No downtime — active connections finish on the old worker.

Step 5 — Reload Apache

Same idea for Apache: sudo apachectl configtest, then sudo systemctl reload apache2 (Ubuntu/Debian) or sudo systemctl reload httpd (RHEL/Fedora).

Step 6 — Verify the New Cert

Reopen your site in a private/incognito browser window. Click the padlock → Connection is secure → Certificate is valid. The new expiry date should be visible. Also re-run the SSL Checker for an unbiased verdict.

Clearing Chrome and Firefox Warnings

Once the new cert is served, Chrome and Firefox pick it up automatically on the next request. If you still see a warning: clear browser cache (Ctrl+Shift+Del), close all tabs to the site, and reopen. On mobile, force-quit the browser app.

Preventing Future Expiries (Automation)

Let's Encrypt / Certbot

Modern Certbot installs a systemd timer or cron job automatically. Verify: systemctl list-timers | grep certbot. If missing, add: 0 3 * * * root certbot renew --quiet && systemctl reload nginx to /etc/cron.d/certbot.

Paid certificates

Most CAs offer email reminders 30/14/7 days out. Layer on an uptime monitor that alerts on SSL expiry (StatusCake, UptimeRobot, Better Uptime all support this).

Cloud platforms

Cloudflare, AWS Certificate Manager, Vercel, and Netlify auto-renew SSL as long as DNS points at them. Set up correctly, you'll never touch the cert again.

Troubleshooting Renewal Failures

1. 'HTTP-01 challenge failed' — port 80 must be open. Check firewalls and web-server config for a working /.well-known/acme-challenge/ path.
2. 'Rate limited' — Let's Encrypt allows 5 duplicate certs per week. Wait or use --staging for tests.
3. 'Domain does not resolve' — check DNS A/AAAA records point to this server.
4. 'Certificate not renewed' — check /var/log/letsencrypt/letsencrypt.log for the real error.

Security Best Practices

• Enable HSTS with a preload directive after you're confident renewals are automated.
• Use TLS 1.2 and 1.3 only — disable older SSLv3, TLS 1.0 and 1.1.
• Prefer ECDSA certificates (smaller, faster) unless you need RSA for compatibility.
• Monitor Certificate Transparency logs (crt.sh) to catch unauthorized certs.
• Store private keys with mode 0600 owned by root — no group or world read.