Fix 'Certificate Has Expired' Error: Emergency Response Guide

You’re seeing this in your browser, monitoring, or logs:

NET::ERR_CERT_DATE_INVALID

SSL_ERROR_EXPIRED_CERT_ALERT

certificate has expired

x509: certificate has expired or is not yet valid

Your site is down. Users are getting security warnings. Revenue is bleeding. Here’s how to fix it right now.

Fastest Fix: 60-Second Diagnosis

Run this from any machine that can reach your server:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates

Output:

notBefore=Jan 15 00:00:00 2025 GMT
notAfter=Jan 14 23:59:59 2026 GMT    ← This date has passed

If notAfter is in the past, your certificate is expired. Continue below.

Check how long it’s been expired:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -enddate -checkend 0

If it says Certificate will expire — it’s already expired.

Emergency Renewal: Let’s Encrypt (Certbot)

If you’re using Let’s Encrypt, this is the fastest path back online:

# Attempt automatic renewal
sudo certbot renew --force-renewal

# If that fails, renew a specific certificate
sudo certbot certonly --nginx -d yourdomain.com -d www.yourdomain.com

# Or for Apache
sudo certbot certonly --apache -d yourdomain.com -d www.yourdomain.com

# Or standalone (stops web server temporarily)
sudo systemctl stop nginx
sudo certbot certonly --standalone -d yourdomain.com -d www.yourdomain.com
sudo systemctl start nginx

If Certbot fails with authorization errors:

# Check DNS is pointing to this server
dig +short yourdomain.com

# Use DNS challenge if HTTP validation fails
sudo certbot certonly --manual --preferred-challenges dns -d yourdomain.com

After renewal, verify the new certificate:

sudo certbot certificates

Emergency Renewal: Commercial CA (DigiCert, Sectigo, GlobalSign)

For commercial certificates:

1. Log into your CA’s portal (DigiCert CertCentral, Sectigo, etc.)
2. Find the expired certificate and click Reissue/Renew
3. Generate a new CSR if required:

openssl req -new -newkey rsa:2048 -nodes \
  -keyout yourdomain.key \
  -out yourdomain.csr \
  -subj "/CN=yourdomain.com/O=Your Company/L=City/ST=State/C=US"

4. Submit the CSR to your CA portal
5. Complete domain validation (email, DNS CNAME, or HTTP file)
6. Download the new certificate once issued

Most commercial CAs can reissue within minutes if domain validation is already cached.

Emergency Response Flow

Deploy the New Certificate

Nginx

# Copy new cert files
sudo cp fullchain.pem /etc/nginx/ssl/yourdomain.com/fullchain.pem
sudo cp privkey.pem /etc/nginx/ssl/yourdomain.com/privkey.pem

# Test config before reload
sudo nginx -t

# Reload without downtime
sudo systemctl reload nginx

Verify your Nginx SSL config points to the right files:

server {
    listen 443 ssl;
    server_name yourdomain.com;
    ssl_certificate /etc/nginx/ssl/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/yourdomain.com/privkey.pem;
}

Apache

# Copy new cert files
sudo cp yourdomain.crt /etc/apache2/ssl/yourdomain.crt
sudo cp yourdomain.key /etc/apache2/ssl/yourdomain.key
sudo cp chain.crt /etc/apache2/ssl/chain.crt

# Test config
sudo apachectl configtest

# Reload
sudo systemctl reload apache2

Apache SSL config:

<VirtualHost *:443>
    ServerName yourdomain.com
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/yourdomain.crt
    SSLCertificateKeyFile /etc/apache2/ssl/yourdomain.key
    SSLCertificateChainFile /etc/apache2/ssl/chain.crt
</VirtualHost>

IIS (Windows Server)

# Import the new certificate (PFX format)
$password = ConvertTo-SecureString -String "YourPfxPassword" -Force -AsPlainText
Import-PfxCertificate -FilePath "C:\certs\yourdomain.pfx" -CertStoreLocation Cert:\LocalMachine\My -Password $password

# Get the new certificate thumbprint
$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*yourdomain.com*" } | Sort-Object NotAfter -Descending | Select-Object -First 1

# Bind to IIS site
$binding = Get-WebBinding -Name "YourSiteName" -Protocol https
$binding.AddSslCertificate($cert.Thumbprint, "My")

# Or via netsh for non-IIS HTTPS services
netsh http update sslcert ipport=0.0.0.0:443 certhash=$($cert.Thumbprint) appid='{your-app-guid}'

AWS ALB / CloudFront

# Upload new certificate to ACM
aws acm import-certificate \
  --certificate fileb://yourdomain.crt \
  --private-key fileb://yourdomain.key \
  --certificate-chain fileb://chain.crt \
  --region us-east-1

# Or request a new ACM certificate (auto-renews)
aws acm request-certificate \
  --domain-name yourdomain.com \
  --subject-alternative-names www.yourdomain.com \
  --validation-method DNS

# Update ALB listener to use new cert ARN
aws elbv2 modify-listener \
  --listener-arn arn:aws:elasticloadbalancing:... \
  --certificates CertificateArn=arn:aws:acm:...

HAProxy

# Combine cert + key into single PEM
cat yourdomain.crt chain.crt yourdomain.key > /etc/haproxy/certs/yourdomain.pem

# Test config
haproxy -c -f /etc/haproxy/haproxy.cfg

# Reload
sudo systemctl reload haproxy

Verify the Fix

After deploying, confirm the new certificate is live:

# Check expiry date
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates

# Check full chain
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates

# Verify chain is complete (no missing intermediates)
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null -showcerts

Check from multiple locations (CDN caching can serve old certs):

# Force bypass CDN cache
curl -vI --resolve yourdomain.com:443:ORIGIN_IP https://yourdomain.com 2>&1 | grep -E "expire|subject|issuer"

# Verify the timer is active
sudo systemctl status certbot.timer

# If not active, enable it
sudo systemctl enable --now certbot.timer

# Test renewal works
sudo certbot renew --dry-run

# Simple cron-based check (runs daily at 9 AM)
# Add to /etc/cron.d/cert-check:
0 9 * * * root echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -checkend 2592000 || echo "CERT EXPIRING WITHIN 30 DAYS" | mail -s "Certificate Alert" ops@company.com

#!/bin/bash
DOMAINS="yourdomain.com api.yourdomain.com app.yourdomain.com"
WARN_DAYS=30

for domain in $DOMAINS; do
  expiry=$(echo | openssl s_client -connect "$domain:443" -servername "$domain" 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
  expiry_epoch=$(date -d "$expiry" +%s)
  now_epoch=$(date +%s)
  days_left=$(( (expiry_epoch - now_epoch) / 86400 ))
  
  if [ "$days_left" -lt "$WARN_DAYS" ]; then
    echo "WARNING: $domain expires in $days_left days ($expiry)"
  fi
done

# Example: Certbot with a commercial CA's ACME endpoint
certbot certonly --server https://acme.ca-provider.com/v2/directory \
  --eab-kid YOUR_KID --eab-hmac-key YOUR_HMAC \
  -d yourdomain.com

# Download the intermediate from your CA and concatenate
cat yourdomain.crt intermediate.crt > fullchain.crt

# CloudFlare
curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/purge_cache" \
  -H "Authorization: Bearer TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"purge_everything":true}'

# Compare modulus of cert and key (must match)
openssl x509 -noout -modulus -in yourdomain.crt | md5sum
openssl rsa -noout -modulus -in yourdomain.key | md5sum