SSL certificate expired? How to prevent downtime from expiring certs

Published April 24, 2026 • 10 min read

It happened again. A customer sent you a screenshot of a scary red browser warning: "Your connection is not private." Your SSL certificate expired, and you had no idea.

SSL certificate expiration is one of the most preventable causes of website downtime, yet it happens to experienced developers all the time. LinkedIn, Microsoft, Ericsson, and even the White House have all suffered from expired certificates.

88% Of visitors will never return after seeing a security warning

Why SSL Expiry Is So Common (And Costly)

SSL certificates typically expire every 90 days (Let's Encrypt) or 1-2 years (paid certificates). That's plenty of time to forget about them. The consequences?

⚠️ The Hidden Cost of SSL Expiry

It's not just about the downtime. Every customer who sees that scary red warning forms an opinion about your company's professionalism. For e-commerce sites, this translates directly to abandoned carts and lost sales.

Immediate Fix: What To Do Right Now

If you're reading this with an expired certificate, here's your emergency action plan:

1

Check Your Current Certificate

Verify expiration with: openssl s_client -connect yoursite.com:443 -servername yoursite.com | openssl x509 -noout -dates Or use an online SSL checker like SSL Labs.

2

Renew Immediately

If using Let's Encrypt: sudo certbot renew For paid certs: Log into your certificate provider and initiate renewal. Download and install new certificate files.

3

Restart Web Server

Nginx: sudo systemctl restart nginx Apache: sudo systemctl restart apache2 Verify with multiple browsers and SSL checkers.

4

Set Up Auto-Renewal

Don't let this happen again. See automation section below to prevent future expiry.

The Long-Term Fix: Automate Everything

Manual certificate management is a ticking time bomb. Here's how to automate renewal so you never think about SSL expiry again.

Option 1: Let's Encrypt with Certbot (Recommended)

Let's Encrypt provides free SSL certificates that auto-renew. Most modern servers can be set up in minutes:

# Install Certbot (Ubuntu/Debian)
sudo apt update
sudo apt install certbot python3-certbot-nginx

# Obtain and install certificate
sudo certbot --nginx -d yoursite.com -d www.yoursite.com

# Test auto-renewal (runs twice daily via systemd timer)
sudo certbot renew --dry-run

✅ Certbot Auto-Renewal Explained

Certbot installs a systemd timer that runs certbot renew twice daily. This command checks all certificates and renews any expiring within 30 days. It only renews when needed—no unnecessary API calls.

Option 2: Cloud-Integrated Certificates

If you're using a modern hosting platform, SSL might be handled automatically:

Option 3: Container/Kubernetes Solutions

For Docker and Kubernetes deployments, use cert-manager:

# Install cert-manager in Kubernetes
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml

# Create an Issuer for Let's Encrypt
kubectl apply -f cluster-issuer.yaml
# Cert-manager automatically renews certificates before expiry

The Safety Net: SSL Expiration Monitoring

Even with auto-renewal, things can go wrong. Auto-renewal can fail due to:

You need a backup plan: SSL expiration monitoring.

Setting Up SSL Expiry Alerts

Monitoring Setup Checklist

  • Set alerts for 30 days before expiration
  • Set secondary alerts for 14 days before
  • Set critical alerts for 7 days before
  • Use multiple notification channels (email + SMS)
  • Test alerts to ensure they're working
  • Monitor all certificates (production, staging, subdomains)

Most uptime monitoring services (including StayAlive) offer SSL certificate expiry monitoring as a standard feature. This means you'll get notified days or weeks before expiration—plenty of time to fix any auto-renewal issues.

SSL Best Practices Checklist

Certificate Management Best Practices

  • Use Let's Encrypt for free, auto-renewing certificates
  • Install and configure certbot with auto-renewal
  • Test auto-renewal with --dry-run after setup
  • Set up SSL expiry monitoring with 30/14/7 day alerts
  • Include all subdomains in certificate (or use wildcard)
  • Use strong TLS versions (1.2 minimum, 1.3 preferred)
  • Implement HTTP Strict Transport Security (HSTS)
  • Document your SSL setup for team members

Common SSL Issues and Solutions

"Certificate Not Trusted" Errors

Usually means intermediate certificates aren't installed. Include the full chain when installing your certificate.

Mixed Content Warnings

Your page loads over HTTPS but includes HTTP resources (images, scripts, CSS). Use browser dev tools to find and update all resources to HTTPS.

Certificate Mismatch

Certificate doesn't cover the domain being accessed. Use a wildcard certificate (*.yoursite.com) or include all subdomains in the SAN list.

🔄 Wildcard Certificates

A wildcard certificate (*.yoursite.com) covers all subdomains. Let's Encrypt supports wildcards but requires DNS validation instead of HTTP validation. This is worth the extra setup if you have many subdomains.

Never worry about SSL expiry again

StayAlive automatically monitors your SSL certificates and alerts you 30, 14, and 7 days before expiration. Combined with Let's Encrypt auto-renewal, you'll never think about certificates again.

Start Monitoring Free

Summary: Your SSL Prevention Strategy

  1. Switch to Let's Encrypt for free, renewable certificates
  2. Configure auto-renewal with certbot or equivalent
  3. Test the renewal process before relying on it
  4. Set up expiry monitoring as a safety net
  5. Document your setup for future reference

SSL certificate management doesn't have to be stressful. With automation and monitoring, you can set it up once and forget about it—confident that your site will stay secure and accessible.

Related Articles