SSL certificate expiring: how to renew it

Certificates expire on a schedule and most hosts renew them automatically. When you get this alert with fewer than 20 days left, automatic renewal has probably failed somewhere. Find the issuer, renew, and check.

Is this urgent?

Within 24 hours if under 7 days. On the day it expires, visitors see a full-page warning.

Easy fix, no technical skills

Find who issues the certificate: our SSL checker shows the issuer. Let's Encrypt or ZeroSSL means your host or Cloudflare renews it; Sectigo, DigiCert or GoDaddy usually means a paid certificate you renew yourself.
cPanel: SSL/TLS Status, tick the domain, Run AutoSSL.
Cloudflare: SSL/TLS, Edge Certificates. Universal SSL renews itself; if the status is not Active, use Disable then Enable Universal SSL.
Managed platforms (Shopify, Wix, Squarespace, Webflow): certificates are automatic. If the padlock is missing, check the domain is connected correctly in the platform's domain settings.
Paid certificate: buy the renewal from the seller, generate a new request in your control panel, install the new certificate.

Hand it to your IT person

Copy this into an email or chat. Replace the brackets with the details from your alert.

The certificate for example.com expires on (date), issued by (issuer). Please renew it (certbot renew, AutoSSL or the vendor portal), install it and reload the web server. Check with the openssl command below.

Technical fix (commands)

Read the current dates and issuer.

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer -subject

Certbot: see certificates, test renewal, renew and reload Nginx.

sudo certbot certificates
sudo certbot renew --dry-run
sudo certbot renew && sudo systemctl reload nginx

Check the renewal timer exists.
```
systemctl list-timers | grep certbot
```

Issue a new certificate for Nginx.

sudo certbot --nginx -d example.com -d www.example.com

Check it worked

Run the openssl command again: notAfter should be about 90 days (Let's Encrypt) or a year ahead. Our SSL checker shows the new date within a day.

Check the certificate now with the free tool. All free tools.

Prevent it next time

Keep this expiry alert on; it fires at 30, 14, 7, 3 and 1 days.
For your own server, check certbot's timer after any system change.
Note the renewal date of paid certificates in your calendar.

The same fix on other platforms

Common questions

Is this urgent?

Within 24 hours if under 7 days. On the day it expires, visitors see a full-page warning.

Can I fix this without technical skills?

Yes. The easy fix below needs no technical skills; the commands are only for your IT person.

How long does it take?

About 15 minutes once you know who runs the website.

Hear about this before your customers do

Add your website and we check uptime, certificates, domains and email security for you, free.

Add my website Scan it first