SSL certificate expired: what to do in the next 30 minutes

Updated 21 October 2026

1. Confirm it's really the certificate

Chrome shows NET::ERR_CERT_DATE_INVALID and Firefox SEC_ERROR_EXPIRED_CERTIFICATE when a certificate's validity dates don't match the device clock. Both browsers' help pages note that a wrong system clock can cause the same error, so check from a second device. Then check the served certificate's "not after" date with our free checker.

2. Find which host and port

The error might be only on www, the bare domain, a mail port or an API subdomain. Check each.

3. Renew or re-issue

• ACME / Let's Encrypt: run the client's renew command and look at its logs. Common causes: port 80 blocked for HTTP-01, a changed DNS API token for DNS-01, or a cron job that stopped.
• Hosting panel (cPanel/Plesk etc.): re-run the AutoSSL/Let's Encrypt job from the panel.
• Paid certificate: renew with the CA or reseller, complete validation, then install the new certificate and full chain.
• CDN / load balancer: confirm the new certificate is attached to the right listener.

4. Reload and verify

Reload the web server or proxy, then re-check the served certificate from outside your network. A renewed file on disk doesn't help until the process serving traffic picks it up.

5. Tell the client, then prevent the next one

Send a short note: what happened, when it was fixed, and what you've changed. Then monitor every host's served certificate with alerts at 30, 14 and 3 days.

Look up 25 domains free Check a certificate

Sources

• Google Chrome Help: Fix connection errors (checked 21 Oct 2026)
• Firefox source: certificate time-error support page (checked 21 Oct 2026)
• Let's Encrypt: Getting started (checked 21 Oct 2026)
• RFC 8555: Automatic Certificate Management Environment (ACME) (checked 21 Oct 2026)