Printer TLS Certificate Expired: Fix in Under 5 Minutes

Yeah, that printer TLS certificate expired error is a pain. You try to print, and your computer just throws up a warning or refuses to connect. The good news: this is a software problem, not a hardware one. You don't need a new printer.

The Quick Fix: Delete the Certificate from the Printer

What's actually happening here is your printer has a self-signed certificate that rotated or expired. The printer doesn't automatically renew it like a browser does for websites. You need to manually clear the old one. Here's how:

1. Find your printer's IP address — usually on the printer's display under Network Settings, or you can press the Info button on older models. Write it down. It looks like 192.168.1.105 or something similar.
2. Open a web browser and type that IP address in the address bar. You might see a security warning — that's the expired cert. Click Advanced then Proceed anyway (or Continue).
3. Log into the printer's admin panel. Default username is often admin, password is admin or password — check the sticker on the back or your manual if those don't work.
4. Find the Certificate section. Look under Security, Certificates, or HTTPS. Exact path differs by brand:
   • HP: Networking > Advanced > Security > Certificate Management
   • Brother: Network > Security > SSL/TLS
   • Canon: Security > Certificate Settings
   • Epson: Network Settings > Security > SSL/TLS
5. Delete the expired certificate. There should be a Delete or Remove option next to the certificate named something like Self-signed Certificate. Confirm it.
6. Reboot the printer by turning it off, waiting 30 seconds, and turning it back on. After reboot, the printer automatically generates a fresh self-signed certificate.

That's it. No more expired cert error. Your computer will still show a warning about the new self-signed cert because it's not from a trusted authority, but that's normal and safe for a home or small office printer.

Why This Works

The reason step 5 works is that the printer creates a self-signed certificate on first boot or after a factory reset. Once that certificate expires (usually after 1–5 years depending on the model), the printer keeps using the old one. It just sits there, expired, because the firmware never checks or renews it. By deleting the expired cert, you force the printer to generate a new one when it restarts. The new certificate has a fresh expiry date, so your devices trust the connection again — usually for another few years.

If you skip the reboot, the printer might still hold the old expired cert in memory. The reboot clears that cache and triggers the cert creation routine in the startup script (or equivalent firmware process).

Less Common Variations

1. The Certificate Is Stuck and Won't Delete

Some printers (looking at you, older HP LaserJet models) don't let you delete the only certificate. In that case, you can generate a new self-signed certificate from the same menu. Look for Generate Self-signed Certificate or Create New Certificate. Fill in fields like Common Name (CN) with your printer's IP or hostname, set validity to 5 or 10 years, and save it. Then reboot.

2. The Error Shows on Your Computer, Not the Printer

If Windows or macOS shows the TLS expired warning but the printer works fine on its own, the issue might be cached on your computer. Go to your OS's certificate store and delete the old printer certificate:

• Windows: Open certmgr.msc, go to Trusted Root Certification Authorities > Certificates, find your printer's cert (often starts with its IP or hostname), right-click delete.
• macOS: Open Keychain Access, search for your printer's IP or name, delete the certificate.

3. The Printer Uses a CA-Signed Certificate

If you or your IT department installed a certificate from a real Certificate Authority (like Let's Encrypt or DigiCert) on the printer, that certificate expired. In that case, you need to renew it with the CA and re-upload it. Contact your IT admin or follow the CA's renewal process — it's not a self-signed fix anymore.

How to Prevent This

Set a reminder on your calendar to check the printer's certificate every two years. Write down the expiry date from the current certificate (visible in the same Security section of the web interface). Or use a monitoring tool like check_ssl for Nagios or UptimeRobot (if your printer is on a static IP) that alerts you 30 days before expiry.

If you're comfortable, you can generate a 10-year self-signed certificate manually — most printers allow setting validity up to 3650 days. That gives you a decade without problems.

One last thing: avoid buying printers that force you to use their cloud service for basic printing. That's a different kind of pain. Stick with standard network printers that let you manage certs locally.