SSL certificate expired — what to do

Browsers are warning visitors, or the site will not load over HTTPS. Treat it as an outage: renew the cert, confirm the chain, then add monitoring so the calendar does not bite you again.

1. Confirm it is really the cert

Open the site in a private window. If you see “Your connection is not private,” NET::ERR_CERT_DATE_INVALID, or a padlock with a warning, the certificate is expired or not trusted. Also check the apex and www — they can use different certs.

2. Renew where the cert was issued

Let’s Encrypt / Certbot / Caddy / Traefik: run your usual renew (or restart the ACME client). Fix DNS and port 80/443 if issuance fails.
Host panel (cPanel, Plesk, Cloudflare, Netlify, Vercel): trigger “Renew SSL” or re-enable automatic HTTPS.
Bought cert: re-issue from the CA portal and install the new full chain on the load balancer or origin.

3. Verify after renew

Hard-refresh, check mobile data (not only office Wi‑Fi), and hit both www and apex. Payment and login pages are the first places customers notice.

4. Stop the next fire drill

Expired certs are usually calendar failures, not exotic bugs. Put the hostname on a watchlist that emails at 30 / 14 / 7 / 1 days remaining.

Run a free SSL + domain check on Expiry Watch, then add up to 3 hosts to the free watchlist. Agencies watching more clients can subscribe to Pro.