Fix an Expired or Invalid SSL Certificate

What this means

Why it matters

How to fix it

1. 1

   1. Confirm exactly what's wrong

   Diagnose the specific failure before renewing blindly. Open the site in Chrome, click the padlock or warning, and view the certificate to see the expiry date and the domains it covers. From a terminal, run echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates -subject -issuer to print the validity dates, subject, and issuer. Use SSL Labs (ssllabs.com/ssltest) for a full report including chain completeness. This tells you whether you need a renewal (expired), a reissue with the right hostnames (invalid CN/SAN), or just the intermediate chain installed.

2. 2

   2. Renew or reissue the certificate

   If it simply expired, renew it. With Let's Encrypt, run certbot renew (or certbot renew --force-renewal to renew early). For a commercial cert, log into your CA (DigiCert, Sectigo, GoDaddy, and so on), renew the order, complete domain validation (usually an HTTP file or DNS TXT record), and download the new files. If the cert is invalid because the domain doesn't match, reissue it with the correct hostnames. Include both the apex and www (for example example.com and www.example.com), or use a wildcard *.example.com if you have many subdomains.

3. 3

   3. Install the certificate with the full chain

   A very common 'invalid' cause is a missing intermediate certificate: the leaf cert is fine, but browsers can't build a path back to a trusted root. Always install the full chain (leaf plus intermediate bundle), not just the leaf. On Nginx, point ssl_certificate at the fullchain file. On Apache, set SSLCertificateFile to the cert and, on older versions, SSLCertificateChainFile for the intermediates (Apache 2.4.8+ reads the intermediates from a combined SSLCertificateFile bundle). Restart the web server and re-test with SSL Labs, aiming for a report showing a complete, trusted chain with no 'extra download' warning.

4. 4

   4. Turn on auto-renewal so it never lapses again

   Most expired-cert incidents are pure process failures: nobody renewed in time. Let's Encrypt and Certbot install a systemd timer or cron job by default. Verify it with systemctl list-timers | grep certbot and test a dry run using certbot renew --dry-run. Managed platforms (Cloudflare, Vercel, Netlify, Shopify, Wix, Squarespace, AWS ACM) auto-renew for you as long as DNS still points at them. For manually managed commercial certs, set a calendar reminder well before expiry and add an external monitor that emails you when the cert is within about two weeks of expiring. Shorter certificate lifetimes make automation essential, not optional.

5. 5

   5. Verify HTTPS end-to-end and clear caches

   After the new cert is live, load the site in a fresh incognito window and confirm the padlock shows with no warning. Re-check that both https://example.com and https://www.example.com resolve cleanly, since the invalid state often affects only one hostname. If you use a CDN or reverse proxy (Cloudflare, Fastly), make sure the edge certificate and the origin certificate are both valid. A valid edge cert with an expired origin cert still breaks in Cloudflare's 'Full (strict)' SSL mode. Finally, in Google Search Console, use URL Inspection and 'Test Live URL' to confirm Googlebot can now fetch the page.

Example

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;   # force HTTPS
}

server {
    listen 443 ssl;
    http2 on;
    server_name example.com www.example.com;

    # fullchain.pem = leaf certificate + intermediate CA bundle
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    # ... rest of your config
}

# Certbot's systemd timer renews and reloads automatically. Verify with:
#   sudo certbot renew --dry-run
#   systemctl list-timers | grep certbot

Nginx: serve the full certificate chain and redirect HTTP to HTTPS. Point ssl_certificate at the fullchain file (leaf plus intermediates), not just the leaf, to avoid 'invalid chain' errors.

Platform-specific steps

Frequently asked