What Happens When an SSL Certificate Expires

The moment it expires: what visitors see

The instant a certificate's validity window ends, browsers stop trusting the connection. Chrome shows 'Your connection is not private' with a NET::ERR_CERT_DATE_INVALID code; Firefox and Safari show their own equivalents. This is an interstitial warning page, not a subtle padlock change — most visitors hit it and leave immediately.

Critically, this is not a gentle degradation. There is no grace period the way there is with an expired domain. A certificate valid until 23:59:59 is trusted; one second later it is rejected outright. The site is still being served correctly by your server — the browser is simply refusing to show it to protect the user.

What breaks beyond the browser warning

The visible warning is only the part users see. Behind the scenes, an expired certificate breaks anything that connects over HTTPS and validates certificates properly, which is almost everything modern. API clients and mobile apps that call your endpoints will start throwing TLS errors and failing silently. Webhooks from payment processors, CRMs, and third-party services stop being delivered because the receiving end no longer trusts your certificate.

Server-to-server integrations are the nastiest, because they fail quietly. A browser at least shows a human a warning; a scheduled job calling your API just logs an error somewhere nobody is watching. Orders stop syncing, forms stop posting, and you may not notice until reconciliation the next day.

There is reputational and SEO fallout too. Search engines favour secure sites, and a site that becomes unreachable behind a certificate error will bleed traffic and rankings the longer it stays broken. If mail-related services on the same domain rely on TLS, deliverability can wobble as well.

Why the certificate chain matters

Not every 'expired certificate' problem is the certificate you renewed. Your site's certificate is validated as part of a chain: your leaf certificate is signed by an intermediate certificate, which traces back to a trusted root in the browser's store. If any link in that chain is expired, missing, or misconfigured, the whole connection fails — even when your own leaf certificate is perfectly current.

This is why a renewal can appear to succeed yet still throw errors: the new leaf was installed but the intermediate was left stale, or the chain was served in the wrong order. Understanding the chain is what turns a confusing 'but I just renewed it' into a five-minute fix.

How to fix an expired certificate

If auto-renewal was supposed to handle this and did not, find out why before moving on — a broken cron job or a rate-limited CA will bite again in 90 days. Our step-by-step walkthrough covers the common failure modes in SSL certificate expired: how to fix it.

• Confirm the real cause — run the domain through an SSL checker to see whether it's the leaf, an intermediate, or the chain order.
• Issue or renew the certificate with your CA or via your host's automated tooling (Let's Encrypt, ACME, or the control panel).
• Install the full chain, not just the leaf — include the intermediate certificate and serve it in the correct order.
• Reload the web server (nginx, Apache) so the new certificate is actually served; a renewed file on disk does nothing until reloaded.
• Re-verify from an incognito browser and the checker to confirm the warning is gone for real, not just cached away.

Preventing the next expiry

Auto-renewal is necessary but not sufficient. Renewal jobs fail silently — a permissions change, a DNS challenge that no longer resolves, a hitting of the CA's rate limit — and you only discover it when the certificate is already dead. The fix is to monitor the certificate independently of the thing that renews it.

Independent monitoring checks the live, served certificate from the outside and warns you 30, 14, and 7 days out, so a failed renewal surfaces as a calendar reminder rather than an outage. That is exactly what VigilDog's monitoring does across every domain and every client you manage, alongside domain expiry, DNS drift, and email authentication — the other silent failures that share the same root cause: something with a deadline that nobody was watching.