TLS

Your TLS certificate has expired. Here's how to restore the site fast.

Published 2026-05-20 · Last updated 2026-05-20 · Vantyris editorial

What this means for your business

• Every TLS certificate has an expiry date. Let's Encrypt certificates last 90 days; paid certificates typically last 12 months. Auto-renewal handles this in the background — until something breaks the cron job, the API key, or the DNS challenge.
• When the certificate expires, browsers refuse to connect. They show your visitor a security warning rather than your site. Your conversion rate goes to zero until the renewal completes.
• Most expirations are not crypto attacks; they're operational failures. The certificate auto-renewal stopped working three weeks ago and nobody noticed because the host emails went to a mailbox no one reads.

How to fix

Log into your web host or certificate manager, trigger a manual renewal, then investigate why auto-renewal failed.

1. Trigger a manual renewal. Most hosts have a 'Renew now' button in the SSL section of their control panel. Cloudflare's certificate is managed for you and rarely expires; if it does, the issue is at your origin server's certificate, not Cloudflare's edge. Identify which certificate expired (origin vs edge) before chasing the wrong one.
2. If the host UI doesn't help, use the command line. If you're using certbot (the most common Let's Encrypt client), run `sudo certbot renew --force-renewal` on the server. Then reload your web server: `sudo systemctl reload nginx` or `apache2`.
3. Verify. Visit your site in an incognito window. The browser warning should be gone, the padlock should appear. Run a Vantyris scan or ssllabs.com/ssltest to confirm the new certificate's validity period.
4. Investigate why auto-renewal failed. Common causes: the renewal cron stopped firing, the ACME client lost its API key, your DNS provider changed (breaking DNS-01 challenges), or your firewall blocks port 80 (breaking HTTP-01 challenges). Fix the root cause so this doesn't happen again in 90 days.
5. Set up monitoring. Enrol the target in Vantyris continuous monitoring with the 'TLS cert expires within 14 days' alert enabled. Or use a free monitor like UptimeRobot's TLS check. You should never learn about an expired cert from a customer email.

Owner: Your web host's support team, or your developer if you self-host. · Time: 30 minutes if your host supports one-click renewal; longer if you need to debug auto-renewal.

Common gotchas

• Check for the right certificate. If you're behind Cloudflare, three certificates are in play: the visitor-facing edge cert (managed by Cloudflare), the origin cert (managed by you), and any intermediate cert in the chain. An expired edge cert is rare; an expired origin cert is common.
• Some auto-renewals fail silently because the renewal email goes to a noreply mailbox or gets filtered as spam. Set the renewal-notification email to a real human's inbox.
• If you migrated to a new hosting setup recently and copied over the cert, the new server may not have the auto-renewal client installed at all.

How to verify the fix

Vantyris's `tls.cert_expired` finding clears once the new cert is live. Or paste your domain into ssllabs.com/ssltest and confirm the 'Valid until' date is at least 30 days in the future.

Cyber Essentials alignment

This finding informs the following UK NCSC Cyber Essentials control areas:

• A2. Secure configuration — devices and services hardened against the inherent default vulnerabilities.

Vantyris is not a CE certifying body. The mapping above is informational.

Common follow-up questions

References

• Let's Encrypt: automated renewals Vendor
• NCSC: certificate management NCSC

Related explainers

• HTTPS for small business: how to enable it in 15 minutes.
• HSTS: the security header that locks HTTPS on for good.