webzod
account

Renew the expired TLS certificate

tls.cert.expired · effort: minutes

Why it matters

Browsers refuse to open a site whose certificate has expired and show visitors a full-page security warning. API clients and mobile apps fail outright, so the site is effectively down for them.

The fix

  1. Work out who issues and renews the certificate for this host. It is one of an ACME client on your server (certbot, acme.sh, Caddy), a control panel or hosting platform that manages it for you, or a certificate you bought and installed by hand.
  2. If a platform manages it, open its SSL or domain settings, fix the error it shows (usually a DNS record that no longer points at the platform) and trigger a renewal there. Contact their support if it does not recover.
  3. If you run certbot, run the renewal now, read its output for the real error (a port 80 firewall rule, a changed DNS record, a CAA record that excludes your CA), then fix that and run it again.
  4. If you installed a purchased certificate by hand, buy or request a renewal from the CA, install the new certificate together with its intermediate certificates, and replace the old files.
  5. Reload the web server so it picks up the new files, then confirm the new expiry date with the command below.
  6. Prevent a repeat. Make sure automatic renewal runs (a systemd timer or cron job for certbot) and add an expiry monitor that alerts you at least two weeks ahead.
bash 
# renew with certbot, then reload the web server
sudo certbot renew
sudo systemctl reload nginx    # or apache2 / httpd

# confirm the certificate now served
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.