Aprender
SSL Certificate Expired: Diagnosing and Fixing It
An expired certificate does not degrade the site — it stops it. And the most common version of this problem is a certificate that was renewed successfully and never actually loaded.
Ejecuta una auditoría nueva en DomainLens y usa el informe como lista de prioridades.
What visitors see, and what it costs
Browsers meeting an expired certificate show a full-page interstitial before any content loads. There is no partial experience: the visitor sees a security warning and a button they have been trained never to click. Traffic drops to near zero within minutes of expiry.
Googlebot is affected too, though less dramatically. It cannot complete the TLS handshake, so pages fail to fetch. A short outage is recoverable; days of it will pull pages from the index.
Why renewal so often does not take effect
The certificate file on disk and the certificate being served are different things. A web server reads the file at start-up and keeps it in memory, so a renewal that writes a new file changes nothing until the process reloads.
| Cause | Symptom | Fix |
|---|---|---|
| Renewed but not reloaded | New file on disk, old cert served | Reload the web server |
| Renewal job never ran | File itself is expired | Check the timer or cron |
| Renewal failed silently | Errors only in the renewal log | Read the log, fix validation |
| Wrong file referenced | Serving a different certificate | Check the server config path |
| Incomplete chain | Works in some clients, not others | Serve the full chain file |
# What the server is actually presenting
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -dates
# What is on disk
openssl x509 -in /etc/letsencrypt/live/example.com/fullchain.pem -noout -dates
# Different answers mean the server needs a reload:
sudo systemctl reload nginxFixing it now
Verify from outside because a local check can hit a different virtual host or a cached process. The SSL checker reads the live handshake, which is the only view that matches what a visitor gets.
- 1Confirm the served certificate is genuinely expired, rather than a client clock being wrong.
- 2Compare the served dates with the file on disk — if they differ, reload the server and you are done.
- 3If the file itself is expired, run the renewal manually and read its output rather than assuming success.
- 4If renewal fails, the cause is almost always validation: the HTTP challenge path is blocked, or DNS has changed.
- 5After renewal, reload the server and verify from outside, not from the host itself.
- 6Check every hostname on the certificate — a SAN entry that no longer resolves will fail validation for all of them.
Preventing the next one
Alerting on the file rather than the connection is the mistake that lets this recur — the file can be perfectly current while the server serves something else entirely.
- Monitor the served certificate, not the file — that is where the gap appears.
- Alert at 21 days remaining, not 7. Let's Encrypt renews at 30, so an alert at 21 means renewal has already failed twice.
- Make the reload part of the renewal hook so it can never be forgotten.
- Run the renewal timer on a schedule that gives several attempts before expiry.
- Keep the certificate on as few hostnames as practical; each SAN entry is another way for validation to fail.
How DomainLens contributes
DomainLens reads the certificate a host actually presents and reports the issuer, validity window and days remaining as part of every audit — so an expiry approaching in three weeks is visible long before it becomes an outage. For automated renewal see certbot and Let's Encrypt , and for installation see installing an SSL certificate .
- I renewed the certificate but the site still shows it expired. Why?
- The web server is still running with the old certificate in memory. Reload or restart it so the renewed file is served.
- How long does an expired certificate take to hurt rankings?
- Traffic collapses immediately because of the browser warning. Ranking damage takes longer — days rather than hours — but the traffic loss is the urgent part.
- Can I keep serving the site over HTTP while I fix it?
- Only if the site has no HSTS header. With HSTS, browsers refuse to connect over HTTP at all, and there is no fallback.
- Why did automatic renewal fail?
- Usually validation: the /.well-known/acme-challenge path is blocked or redirected, a firewall rule changed, or DNS moved. The renewal log names the specific failure.