Fix Expired Website Certificate: Browser Warning

Start Here: 30-Second Fix

Before you panic — check the date on your own computer first. This sounds stupid but it's the most common reason people see a certificate error. Your laptop battery died and the system clock reset to 2019. Browsers check the certificate expiration against your local clock. If your clock is wrong, every site looks expired.

# Windows: right-click clock → Adjust date/time → turn on 'Set time automatically'
# macOS: System Settings → General → Date & Time → enable 'Set time and date automatically'
# Linux: timedatectl set-ntp true

Wait 10 seconds, refresh the site. If the warning is gone, you're done. If not, the certificate is actually expired on the server side.

5-Minute Fix: Renew the Certificate

If you control the server, you need to renew the SSL certificate. Most people use Let's Encrypt (free) or a paid CA like DigiCert. Here's the real fix.

SSH into your server. You need root or sudo access.
Check what cert you have. Run this command to see the expiration date:
```
openssl x509 -in /etc/letsencrypt/live/yourdomain.com/fullchain.pem -noout -dates
```
If it shows dates in the past, you're toast.
Renew with Certbot (Let's Encrypt). The simplest way:
```
sudo certbot renew
```
This command finds all certs that expire in less than 30 days and renews them. It doesn't always run automatically. If you're on a cron job, check it's working. I've seen servers with a broken cron for months.
Restart your web server. Certbot replaces the cert files, but Apache or Nginx need to reload them:
```
sudo systemctl restart nginx   # or apache2
```
Test it. Visit your site with https://. The warning should be gone. If not, see the advanced section.

What if you use a paid certificate? Log into your CA's portal, download the new cert, and replace the files manually. The process is the same: upload the .crt and .key files to your server, then restart the web server.

15+ Minute Fix: Deep Dive into Stubborn Cases

Sometimes the simple renewal doesn't work. Here's why.

1. Certbot didn't actually renew

Run sudo certbot certificates to list all certs and their status. If it says 'VALID' but the expiration date is wrong, your system clock on the server is off. Set NTP on the server:

sudo timedatectl set-ntp true
sudo systemctl restart systemd-timesyncd

Then try certbot renew again. Certbot uses the server's local time to decide if renewal is needed. If the server clock is set to 2020, it thinks the cert is still valid for years and won't renew.

2. The certificate chain is broken

Browsers need the full chain of trust: your certificate, the intermediate CA, and the root CA. If you're missing the intermediate file, some browsers (especially Safari and Chrome) show errors even with a fresh cert.

Check your web server config. For Nginx:

ssl_certificate /path/to/fullchain.pem;   # This should contain the full chain
ssl_certificate_key /path/to/privkey.pem;

If you're using Apache:

SSLCertificateFile /path/to/cert.pem
SSLCertificateKeyFile /path/to/privkey.pem
SSLCertificateChainFile /path/to/chain.pem   # or use fullchain.pem

The real fix: use the fullchain.pem file instead of just cert.pem. Certbot generates this file automatically. If you're copying files from a different CA, make sure you download the full chain.

3. The certificate is for the wrong domain

You renewed the cert for www.yourdomain.com but the visitor is hitting yourdomain.com without www. Or vice versa. The certificate must cover the exact hostname in the URL. Check the subject:

openssl x509 -in fullchain.pem -noout -subject

It will say something like CN=yourdomain.com. If it's missing the www variant, you need to add it as a SAN (Subject Alternative Name). With Let's Encrypt:

sudo certbot --expand -d yourdomain.com -d www.yourdomain.com

This adds the additional domain to the existing certificate.

4. Cloudflare or CDN is caching an old cert

If you use Cloudflare, they handle the SSL on their edge. Your server's certificate doesn't matter for visitors. But if Cloudflare's certificate expires, you get the warning. In that case:

Log into Cloudflare dashboard
Go to SSL/TLS → Edge Certificates
Check the expiration date of the Universal SSL. If it's expired, click 'Remove' and re-enable it. Cloudflare will issue a new one within minutes.
Alternatively, upload your own certificate under 'Custom SSL Certificate'.

5. DNS propagation or cached redirects

Sometimes the cert is new, but a cached redirect is sending you to the old site. Clear your browser's SSL cache:

# Chrome: chrome://net-internals/#hsts → Query domain → Delete domain
# Then clear browsing data: Settings → Privacy and Security → Clear browsing data → select 'Cached images and files'

Or just use an incognito window. If the warning disappears in incognito, it's a cache issue on your side.

What if the site isn't yours?

Maybe you're visiting a site you don't control. You can't fix their certificate. But you can bypass the warning safely:

In Chrome: click 'Advanced' then 'Proceed to site (unsafe)'. Do this only if you trust the site and know it's just a renewal delay.
In Firefox: click 'Advanced' → 'Accept the Risk and Continue'.
Don't enter passwords or payment info on a site with an expired cert. It's probably fine, but why risk it?

The browser warning exists for good reason. An expired cert can mean the site lost control of its security. Or it could mean the admin is just lazy. You decide.

Prevent it from happening again

For Let's Encrypt users: certbot creates a systemd timer or cron job to auto-renew. Check it exists:

sudo systemctl status certbot.timer   # should say 'active (waiting)'
# Or for older systems:
sudo cat /etc/cron.d/certbot

If the timer is missing, reinstall certbot or set up a cron job that runs twice a day:

0 */12 * * * /usr/bin/certbot renew --quiet

For paid certificates: set up a calendar reminder 30 days before expiration. Most CAs send email reminders, but they often land in spam.

That's it. Start with the clock check, move to renewal, then dig into the chain and DNS. Most cases are fixed in the first 5 minutes. If not, the advanced section covers the weird edge cases I've seen in production.