What Happens When Your SSL Certificate Expires and How to Renew It

What Happens When an SSL Certificate Expires?

SSL Certificates have a finite validity period. When one expires, browsers immediately stop trusting that website's security. The result is an alarming full-page warning instead of your website. In Chrome, users see "Your connection is not private." Firefox shows "Warning: Potential Security Risk Ahead." Other browsers display similar messages.

The consequences of an expired SSL cascade quickly:

• Users leave immediately — most visitors will not click through the advanced warning, especially for sites handling payments or personal data
• Credibility is destroyed — customers who see the warning often do not return, even after you fix the issue
• Conversions stop — sales, sign-ups, and form submissions halt the moment the warning appears
• SEO impact — Google will flag the site as insecure, affecting rankings over time
• Connected services break — APIs, webhooks, and payment gateways requiring HTTPS may stop working

What the Browser Shows When SSL Expires (NET::ERR_CERT_DATE_INVALID)

When a certificate expires, the browser reads the "Valid To" field inside the certificate and finds that the current date has passed it. As a result, the browser refuses the encrypted connection and replaces your actual website with a full-page warning. The most common error code in Chrome and Edge is NET::ERR_CERT_DATE_INVALID. Firefox shows SEC_ERROR_EXPIRED_CERTIFICATE, while Safari states "This Connection Is Not Private."

Here is what both visitors and site owners should understand about this warning:

• The site was not hacked — the warning is caused purely by an expired certificate. The website itself still works, but the browser will not let users reach it because it can no longer verify the connection's security
• The connection is still encrypted — technically the data is still encrypted with the same key, but the trust chain is broken, so the browser refuses to confirm the server's identity
• Users must click "Advanced" themselves — most will not, and they perceive the site as dangerous
• Immediate SEO impact — Googlebot hits the same certificate error when it crawls, so Google cannot fetch your pages normally and flags the site as insecure, hurting rankings over time
• Trust damage lingers — customers who once saw an "insecure" warning often remember it and hesitate to return, even after you have fixed the problem

This is why renewing SSL before it lapses matters more than many people realize. The damage is not just a temporary outage — it simultaneously affects sales, credibility, and SEO rankings.

How to Check Your SSL Certificate Expiry Date

You can check your certificate's expiry date at any time without waiting for it to lapse.

Check via Browser

1. Open your website in Chrome or Firefox
2. Click the padlock icon (🔒) in the address bar
3. Click "Connection is secure" or "Certificate is valid"
4. Click "Certificate" to see full details including the expiry date (Valid to / Expires on)

Check via Online Tools

SSL Checker tools like SSL Labs (ssllabs.com/ssltest) or SSL Shopper provide more detailed information, including the full certificate chain, supported protocols, and the exact expiry date clearly displayed.

Renewing Let's Encrypt SSL (Automatic)

Let's Encrypt certificates have a 90-day lifetime but auto-renew every 60 days, leaving a 30-day safety buffer if auto-renewal fails. For AsiaGB Hosting customers using Let's Encrypt through DirectAdmin, the system handles renewal automatically — no action required on your part.

However, auto-renewal can sometimes fail due to:

• Domain DNS no longer pointing to the server IP
• Server unable to reach Let's Encrypt servers (firewall issues)
• Let's Encrypt rate limits hit during the renewal window
• Domain registration expired before the SSL renewal

We recommend setting up email alerts in DirectAdmin to receive notifications when a certificate is nearing expiry, or doing a manual check once a month to confirm everything is working correctly.

Renewing Paid SSL Certificates

Paid SSL from RapidSSL, GeoTrust, or DigiCert typically has a 1-year validity. Renew at least 30 days before expiry. The renewal process is identical to purchasing a new certificate:

1. Place a renewal order — log in to billing.in.th and order the SSL renewal
2. Generate a new CSR — create a fresh CSR for your domain in DirectAdmin
3. Complete domain validation — go through DCV (Domain Control Validation) again
4. Receive the new certificate — the CA will email you new certificate files
5. Install the new certificate — replace the old certificate in DirectAdmin with the new one

Important: the new certificate's validity period starts from the date of issuance, not from the expiry date of the old one. Renewing 30 days early means losing 30 days of validity, but this is the accepted trade-off for avoiding any site downtime.

Let's Encrypt Auto-Renewal vs Paid SSL Renewal — Key Differences

These two renewal paths differ significantly in lifetime, frequency, and the amount of manual work involved. Understanding the difference helps you plan the right strategy to prevent SSL expiry.

How certbot and auto-renewal work

On a server where Let's Encrypt is installed via certbot, a cron job or systemd timer runs the certbot renew command once or twice a day automatically. This command checks every certificate on the machine; if any has fewer than 30 days of validity left (i.e. 60 days into its 90-day life), it renews it immediately by requesting a fresh certificate through automated domain validation, then reloads the web server to serve the new certificate. All of this happens in the background without any action from you. For AsiaGB Hosting customers using Let's Encrypt through DirectAdmin, the system also handles renewal automatically.

Paid SSL requires a CSR reissue every time

By contrast, paid SSL has no built-in auto-renewal. As expiry approaches you must place a renewal order, generate a new CSR (Certificate Signing Request) from the server, then complete DCV to prove you still own the domain. The CA then issues a new certificate that you install over the old one. Because this process depends largely on a person remembering to act, the risk of forgetting is noticeably higher than with Let's Encrypt — which is why proactive alerts matter so much for paid SSL.

Set Alerts Before SSL Expires (SSL Monitoring)

Whether you use Let's Encrypt or paid SSL, setting up monitoring is the last line of defense that lets you catch a problem before customers hit the warning page. Even auto-renewal can fail silently.

• Enable email alerts in DirectAdmin — configure the system to email you when a certificate is nearing expiry, so you can verify whether auto-renewal is actually running
• Use uptime monitoring with SSL checks — services like UptimeRobot or StatusCake offer free SSL expiry monitoring and warn you several days in advance
• Add a backup calendar reminder — for manually renewed paid SSL, set a calendar reminder that overlaps with the CA's emails for extra certainty
• Check manually once a month — open the site and inspect the padlock, or use an online SSL checker to confirm the real expiry date
• Monitor every subdomain and certificate — if you run multiple certificates, monitor all of them, not just the primary domain

The goal of monitoring is to get at least 7–14 days of advance notice so you have time to act before the certificate actually expires — not to find out only when the warning page is already showing.

Best Practices to Prevent SSL Expiry

• Set a calendar reminder — create a reminder 45 days before the expiry date to give yourself time to act
• Enable auto-renewal — if your hosting or SSL provider supports it, turn it on
• Monitor your inbox — CAs send expiry warning emails at 30, 14, and 7 days before expiry; verify the email address in your account is correct
• Use a monitoring tool — services like UptimeRobot or StatusCake offer free SSL expiry monitoring features
• Keep your domain registration current — if your domain expires, Let's Encrypt cannot renew

Frequently Asked Questions About SSL Renewal

If my SSL expires, does the website stop working entirely?

The website itself keeps running, but the browser blocks visitors with a full-page warning (such as NET::ERR_CERT_DATE_INVALID) before they reach any content. In practice this means the site is unusable for regular visitors, because most will not click "Advanced" to proceed. Renewing or issuing a new certificate makes the warning disappear the moment installation is complete.

Does Let's Encrypt really auto-renew, and do I need to do anything?

Yes — Let's Encrypt certificates last 90 days and certbot renews them automatically every 60 days, so you generally do not need to do anything. Still, enable email alerts and check once a month in case auto-renewal fails — for example if DNS changes, a firewall blocks the server, or the domain expires before the SSL.

If I renew paid SSL before it expires, do I lose the remaining days?

The new certificate counts its validity from the issue date, not from the old certificate's expiry. So renewing 30 days early means losing that window. However, it is a worthwhile trade-off because it gives you time to test the new certificate and prevents the site from ever showing a warning during the transition.

How do I check my SSL expiry date?

The fastest way is to click the padlock icon in your browser's address bar and view the certificate details under "Valid to / Expires on." Alternatively, use an online tool like SSL Labs, which provides more detail including the full certificate chain and supported protocols.