Playbook
    ssl
    easy

    Fix an expired SSL certificate

    Your SSL certificate has expired and browsers are showing a security warning. Here is the fastest path to a clean cert.

    15 minutesLast reviewed 2026-06-09

    What is happening

    When an SSL certificate expires, every visitor sees a full-page browser warning ("Your connection is not private", NET::ERR_CERT_DATE_INVALID). Search engines stop crawling HTTPS pages within hours and your conversion rate drops to near zero until it is fixed.

    Fix it in 3 steps

  1. Find out who issues your cert. Most sites use Let's Encrypt (auto-renew through your host) or a paid CA (GoDaddy, Sectigo, DigiCert). Run openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -issuer to see the issuer.
  2. Renew through your host's panel first. Cloudflare, Netlify, Vercel, cPanel, and Plesk all have a one-click "renew SSL" button. This works ~80% of the time.
  3. If auto-renew failed, delete the old cert in the panel and request a fresh one. The renewal job that failed will normally succeed on a clean install.

    4. If you self-host with Let's Encrypt

    Run:

    sudo certbot renew --force-renewal
sudo systemctl reload nginx

    Then re-test the site in Lemwatch. The SSL grade should go from F back to A within one check cycle.

    Common gotchas

  4. Cron job stopped running. Check sudo systemctl status certbot.timer. Re-enable with sudo systemctl enable --now certbot.timer.
  5. Port 80 is blocked. Let's Encrypt's HTTP-01 challenge needs port 80 reachable. If you redirect 80→443 too aggressively, the challenge fails. Whitelist /.well-known/acme-challenge/ from the redirect.
  6. Wrong domain on the cert. If you added a new subdomain, you need a SAN cert that includes it, not a fresh single-domain cert.

    7. What this doesn't do

    This playbook does not cover EV certificates, code-signing certs, or client-authentication certificates. For those, contact your CA directly.

    All playbooks