An expired SSL certificate is one of the most avoidable outages there is — and one of the most embarrassing. The moment a certificate lapses, browsers slam every visitor with a full-page "Your connection is not private" warning, and your traffic falls off a cliff. It happens to hobby sites and Fortune 500 companies alike, almost always for the same reason: someone simply forgot. Here's why certificates expire, how to monitor them, and how to make sure yours never takes your site down.
What happens when an SSL certificate expires
The instant your certificate passes its expiry date, browsers stop trusting it. Instead of your site, visitors see a red security warning (with codes like NET::ERR_CERT_DATE_INVALID) and most will leave immediately — it looks broken, or worse, dangerous. It's effectively a full outage: no one gets through the warning to your content.
The damage doesn't stop at the website, either. Anything that relies on that certificate — APIs, integrations, apps connecting to your server — can break at the same moment. And because it's a security warning rather than a normal error, it erodes visitor trust even after you fix it. An expired certificate produces exactly the errors covered in our guide on "Your connection is not private".
Why SSL certificates expire in the first place
Certificates are time-limited by design. A shorter lifespan limits the damage if a certificate's private key is ever compromised, and it keeps the web's security hygiene current — so expiry is a security feature, not a flaw.
Typical lifespans:
- Free certificates (like Let's Encrypt) last around 90 days.
- Paid certificates currently last up to about 13 months maximum.
Importantly, maximum certificate lifespans have been getting shorter over time as the industry pushes for tighter security — which means manual renewal is only getting harder to keep up with, and automation more important.
How to check when your certificate expires
Knowing your expiry date is step one. You can see it in seconds by entering your domain into our free SSL Certificate Checker, which shows the validity dates and issuer — our guide on how to check an SSL certificate walks through reading the details. That's perfect for a spot check, but a one-time look isn't a strategy. The real goal is to never be surprised.
The problem with checking manually
Here's the trap: manual checking depends on you remembering to check. Expiry outages almost never happen because the fix was hard — they happen because a renewal reminder went to an old email, a credit card on file expired, or the person who managed it left. Relying on human memory for a hard deadline that arrives every 90 days (and gives no warning when it passes) is exactly why so many sites go down this way. The solution is to take the remembering out of human hands.
How to monitor SSL expiry and get alerted
Put a system in place so an expiry can never sneak up on you:
- Enable auto-renewal. This is the single best safeguard. Let's Encrypt certificates are designed to renew automatically via ACME clients, and most modern hosts renew their included SSL for you. Turn it on and then verify it's actually working.
- Keep billing and contacts current. For paid certificates, an expired payment card or an outdated admin email is a leading cause of "automatic" renewals silently failing.
- Set calendar reminders. Add a reminder a couple of weeks before the expiry date as a human backstop to the automation.
- Use expiry monitoring. Dedicated tools can watch your certificate's expiry date and alert you well before it lapses.
- Monitor your site's uptime. As a final safety net, our free uptime monitoring checks your site regularly and emails you the moment it starts failing — so even if an expiry slips through, you learn about it in minutes rather than from an angry customer.
Layering auto-renewal with monitoring means a single point of failure can't take you down: if renewal fails, monitoring catches it fast.
What to do if your certificate has already expired
If you're reading this because your certificate just expired and your site is throwing warnings:
- Renew or reissue immediately. For Let's Encrypt, force a renewal with your ACME client (e.g. your host's SSL tool or
certbot renew). For paid certificates, renew through your provider and reinstall. - Restart your web server if needed so it picks up the new certificate.
- Verify the fix. Re-check the domain in our SSL Certificate Checker to confirm the new validity dates are live, and run your site through our live website down checker to make sure it's loading cleanly again.
- Then fix the root cause — turn on auto-renewal and monitoring so it can't recur.
Because it's a security warning, some visitors' browsers and caches may take a little while to clear after you renew, so give it a few minutes before assuming the fix didn't work.
The bottom line
An expired SSL certificate is a self-inflicted outage that's almost entirely preventable. Certificates expire on purpose — free ones roughly every 90 days, paid ones up to about 13 months — and the outages happen because manual renewal gets forgotten. Don't rely on memory: enable auto-renewal, keep your billing and contacts current, monitor the expiry date, and back it all up with uptime monitoring so you're alerted the instant anything slips through. Set that up once, and "our SSL expired" becomes a problem you never have to face.