SSL Certificate Expired? How to Renew It

To renew SSL certificates, you order a new certificate for the same domain names, complete validation, install it on every server that uses the old one, and verify it from outside. Renewal never extends the old certificate; it replaces it. If your certificate has already expired, the same steps fix it, and most DV certificates can be validated and installed the same day.

What happens if my SSL certificate expires?

When an SSL certificate expires, browsers block the site with a full-page security warning, and apps, APIs and mail clients that check certificates refuse to connect. Encryption technically still works, but nothing trusts it, so visitors leave and automated connections fail.

• Browsers show an interstitial such as “Your connection is not private” (NET::ERR_CERT_DATE_INVALID).
• API and payment integrations stop with errors like “certificate has expired”.
• Mail servers and clients may refuse TLS connections or show warnings to every user.
• Sales and sign-ups drop, because most visitors will not click through a security warning.

Expired SSL certificate: what to do right now

1. Confirm the cause: check the expiry date the server actually presents, not the date in your account.
2. Order the renewal (or a new certificate) for exactly the same hostnames.
3. Choose the fastest validation method you control, usually DNS or HTTP file.
4. Install the new certificate and its intermediate on every server, load balancer and CDN.
5. Restart or reload the service and test again from outside your network.

How to renew SSL certificates without downtime

To renew without downtime, start before expiry, install the new certificate while the old one is still valid, then switch bindings and reload in one step. Browsers accept the new certificate immediately, so visitors never see a gap.

1. Start early. Begin renewal when about a third of the certificate’s lifetime remains. Lifetimes are getting shorter; see how long SSL certificates last for the current limits.
2. Check the names. List every hostname the current certificate covers and decide whether you need to add or remove any.
3. Generate a new CSR. A CSR (certificate signing request) contains your public key and hostnames. Create a fresh key pair for each renewal where possible.
4. Order and validate. Submit the CSR, then complete domain validation (DV) or, for OV and EV, confirm organization details if the CA’s earlier checks have lapsed.
5. Install alongside the old certificate. Add the new certificate and intermediate to the server, keeping the old one in place until you switch.
6. Switch and reload. Update the binding or configuration, then reload the service. Repeat on every node.
7. Verify. Confirm the new expiry date, hostname match and full chain from outside your network.

Server-specific instructions for Apache, Nginx, IIS and other platforms are in our guide to install an SSL certificate.

Renewing OV and EV certificates

OV (organization validated) and EV (extended validation) renewals take longer than DV, because the CA may need to re-check your organization’s registration, address or phone number. If those checks are still within the CA’s reuse period, renewal can be almost as fast as DV. Start OV and EV renewals earlier, and keep your public business listings and registry records up to date so verification calls reach the right person.

Renew the same product or switch?

Renewing the same product keeps your process unchanged. Renewal is also a good moment to fix mismatches, for example moving several single-domain certificates onto one multi-domain certificate, or switching to a wildcard if you keep adding subdomains.

Pitfall: Renewing the certificate in your account does nothing until it is installed. Many “expired” outages happen after the renewal was paid and issued, because the new file never reached the server.

Pitfall: Load balancers, CDNs and reverse proxies often hold their own copy of the certificate. Update every copy, not just the origin server.

Pitfall: Forgetting the intermediate certificate makes the site work in some browsers and fail in others and in API clients. Always install the full chain your CA provides.

Do SSL certificates renew automatically?

No certificate renews itself; a subscription or plan may renew automatically, but a new certificate still has to be issued, validated and installed on your server. Only ACME automation (Automatic Certificate Management Environment, a standard protocol for issuing certificates by software) or a management agent handles all of those steps for you.

At BUY-SSL.com, multi-year terms are plan or subscription terms with free reissues during the term. Each certificate issued under a plan still follows the maximum lifetime set by the CA/Browser Forum, so you reissue and reinstall during the term even when you do not pay again.

Does IIS automatically renew SSL certificates?

No. IIS (Internet Information Services) uses whatever certificate is bound to a site and does not request public certificates on its own. Windows auto-enrollment works only with an internal Microsoft CA. For public certificates on IIS, use an ACME client for Windows that updates the certificate store and site bindings, or renew manually.

How to automate SSL certificate renewal

Automating renewal takes four building blocks. Keep expiry monitoring as a safety net, because automation can fail silently.

For inventories, monitoring and automation across many servers, see our guide to SSL certificate management.

How to update an SSL certificate

Updating an SSL certificate means replacing the installed certificate with a newly issued one, either at renewal or when you reissue to change names or keys. The renewal process is the same either way: new CSR, validation, installation, verification.

New certificate, same key?

Many CAs accept a CSR built on your existing private key, which can be convenient for pinned or hard-to-update systems. A new key pair is the better default. It limits the damage if an old key was ever copied, and it costs nothing extra to generate.

Should I delete expired SSL certificates?

Remove expired and replaced certificates from server configurations and certificate stores once the new one is live and verified. Leaving them in place makes it easy to bind the wrong certificate by mistake. Keep a record in your inventory, and keep backups only if your policy requires them.

Expired SSL certificate errors: cause and fix

Error or symptom	Likely cause	Fix
NET::ERR_CERT_DATE_INVALID (Chrome, Edge)	Certificate expired, or device clock is wrong	Install the renewed certificate; check the client’s date and time
SEC_ERROR_EXPIRED_CERTIFICATE (Firefox)	Server still presents the old certificate	Update the binding or config and reload the service
Warning persists after renewal	CDN, load balancer or second node still has the old copy	Upload the new certificate to every endpoint
“certificate has expired” in API or curl	Expired leaf or outdated intermediate on the server	Install the new certificate with the current chain
Works in browsers, fails in apps	Intermediate certificate missing	Install the full chain from your CA
Name mismatch after renewal	A hostname was dropped from the new order	Reissue with all required names

After any renewal, run the domain through our SSL checker to confirm the new expiry date, hostname coverage and chain. If you want to switch products at renewal, for example from DV to OV or to a wildcard, compare all SSL certificates before you order.