Your SSL certificate just expired. Here's how to get the site back up.

Updated August 2026 · about a 4-minute read

If you're reading this while your site throws a red warning at every visitor — breathe. This is a fast fix, not a disaster. No data is lost, nothing is broken in your code, and the moment you serve a valid certificate again the warning disappears for everyone, instantly. Let's get you there, then figure out why it happened so you're not back here in 90 days.

Fix it now

The fix depends on where your certificate actually comes from. Ninety percent of cases are one of these:

If you use Let's Encrypt / certbot

The auto-renewal probably stalled. Run it by hand and reload the server:

sudo certbot renew
sudo systemctl reload nginx   # or: apache2

If certbot renew throws an error, read it — it usually names the exact reason the automatic renewal has been failing (a validation path that no longer works, a port that's blocked, a rate limit). That error is the root cause you've been missing.

If your host or panel manages it (cPanel, Plesk, most shared hosts)

Log into the hosting panel and look for the SSL/TLS section. There's almost always a "renew" or "reissue" button. On managed platforms this is a two-minute job — the panel does the validation and installation for you.

If a CDN or proxy sits in front (Cloudflare, etc.)

Check the SSL/TLS settings there first. The certificate a visitor sees is the edge certificate, not the one on your origin server — so an expired cert can be at the edge even when your server looks fine, or the reverse. Renew whichever one has actually lapsed.

Whichever path you're on: the browser trusts a valid certificate the instant it's served. There's no propagation delay, no cache to wait out. Reload, and the warning's gone.

Now — why did it expire?

This is the part worth thirty seconds of honesty, because "it was supposed to auto-renew" is what almost everyone says right before it happens again. Auto-renewal runs on your infrastructure, and it fails silently more often than anyone expects:

• A cron job died, or never survived a server migration.
• A DNS record the renewal uses for validation got moved during some unrelated change.
• The server was rebuilt and the renewal setup didn't come with it.
• An API token expired, or you quietly hit a rate limit.

In every one of those, the certificate keeps counting down on schedule and nothing tells you the replacement isn't coming. The failure is invisible right up until it's a red screen in front of your customers. That's not a you-problem — it's the design. Renewal automation has no idea whether it succeeded from the outside.

Make sure this is the last time

The fix isn't "be more careful" — nobody can watch a date that's 89 days away and quietly stops working. The fix is to have something check the live certificate from the outside, every day, and shout at you well before it lapses. Not the renewal job reporting on itself, but an independent set of eyes on the cert the world actually sees.

Set the warning window somewhere sane — 30 days out gives you room to fix a broken cron over coffee instead of at 9pm. That's the whole difference between this being a scheduled five-minute task and being an outage. I wrote up the deeper version of this in how to actually stop a certificate expiring on you.