Urgent actions to restore your site security and prevent it from happening again.
From any machine, without server access. Replace the domain and read the notAfter line.
openssl s_client -connect exemple.fr:443 -servername exemple.fr </dev/null 2>/dev/null \ | openssl x509 -noout -dates
notBefore is the issue date, notAfter the expiry date. If notAfter is in the past, the diagnosis is confirmed: the certificate has expired, while the server itself still answers.
Your SSL certificate has expired and your visitors are greeted by a scary warning page. It's a stressful situation, but don't panic: the problem is reversible and you can fix it quickly. The key is to act fast to minimize the impact on your business and SEO rankings.
An expired SSL certificate effectively blocks access to your site for most visitors. Modern browsers display alarming warnings and most users won't risk continuing. Every minute that passes costs you visitors, sales, and potentially your search engine rankings.
This guide walks you through step by step to resolve the problem as quickly as possible, then implement measures so it never happens again.
Here's what happens when a visitor accesses your site with an expired certificate:
Follow these steps in order to resolve the problem as quickly as possible:
If you're using Let's Encrypt with Certbot, here's the procedure:
Here are the commands to run on your server:
# 1. Force certificate renewal
sudo certbot renew --force-renewal
# 2. Verify the result
sudo certbot certificates
# 3. Reload web server (Nginx)
sudo systemctl reload nginx
# Or for Apache:
sudo systemctl reload apache2
# 4. Test automatic renewal
sudo certbot renew --dry-run
# 5. Check the cron
systemctl list-timers | grep certbotThese commands renew your Let's Encrypt certificate and verify that auto-renewal is properly configured. The --dry-run simulates a renewal without modifying the certificate.
Once the problem is resolved, implement these preventive measures:
No, SSL certificate expiration is not a hack. It's simply a renewal oversight or a failure of the automatic process. Your data and your visitors' data are not compromised by the expiration itself.
Technically possible, but strongly discouraged. Your visitors would see an unsecured site, which is almost as damaging as the certificate error. Focus on quick renewal instead.
Certificate expiration doesn't expose existing data. However, new connections aren't encrypted until the certificate is renewed, which presents a theoretical risk.
Once the certificate is restored, Google should notice the change on its next crawl (usually 1-3 days). The impact on your rankings depends on how long the expiration lasted.
Common causes are: port 80 blocked by firewall, web configuration changed, disk full, or the certbot cron no longer running. Check logs with sudo journalctl -u certbot.
For Let's Encrypt, no. For commercial certificates, it depends on the provider. Some accept the same CSR, others require a new one for each renewal.
An expired SSL certificate is stressful, but it's a problem that typically resolves in less than an hour. The key is to act quickly to minimize the impact on your visitors and SEO. Once the problem is resolved, take time to implement preventive measures.
With MoniTao, you receive automatic alerts well before your certificate expires. It's the safety net that guarantees you'll never have to handle this emergency again. Set up your first HTTPS monitor in under 2 minutes.
Start free, no credit card required.