Your SSL/TLS certificate has expired. Visitors will see a security warning in their browser, and most will not proceed to your site.
Renew your SSL certificate immediately through your certificate provider or enable auto-renewal.
The SSL/TLS certificate installed on your web server has passed its expiration date. Browsers will display a prominent "Your connection is not private" warning and will not establish a secure connection without explicit user override.
An expired certificate effectively makes your website inaccessible to most visitors. Search engines will penalize your rankings, and API integrations will fail.
Verify the current certificate's expiration.
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -datesRenew through your certificate provider. If using Let's Encrypt, use certbot.
# Let's Encrypt renewal:
sudo certbot renew
# Or renew a specific certificate:
sudo certbot certonly --nginx -d yourdomain.com -d www.yourdomain.comReplace the old certificate files and restart your web server.
# Nginx:
sudo nginx -t && sudo systemctl reload nginx
# Apache:
sudo apachectl configtest && sudo systemctl reload apache2Set up automatic renewal so this does not happen again.
# Verify certbot auto-renewal is configured:
sudo certbot renew --dry-run
# Check the cron/timer:
systemctl list-timers | grep certbotConfirm the new certificate is active and valid.
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates -subjectAfter making changes, use our free scanner to verify the fix is working correctly. DNS changes can take up to 48 hours to propagate, but most propagate within minutes.
Let's Encrypt provides free SSL certificates. Use certbot to automatically obtain and install them. Many hosting providers and CDNs also include free SSL.
Let's Encrypt certificates are valid for 90 days. Commercial certificates are typically valid for 1 year. Always enable auto-renewal.
If your mail server uses the same certificate, TLS negotiation may fail. However, most mail servers fall back to unencrypted delivery, so email usually still flows.