Fix guide · HTTPS · high

SSL certificate invalid or expiring

When a certificate expires, or does not match the domain, or its chain is incomplete, browsers show a full-page warning and most visitors leave. Certificates now last 90 days or less, so manual renewal is a matter of when, not if, it gets missed.

Time to fix

10 minutes

Risk if ignored

Your site shows a security warning

Breaks anything?

How to fix it

Renew now, and check the automatic timer is running:

sudo certbot renew
sudo systemctl list-timers | grep certbot

If the timer is missing: sudo systemctl enable --now certbot.timer

SSL/TLS → Edge Certificates shows the visitor-facing certificate:

Universal SSL renews itself. If the origin is the problem, set SSL mode to Full (strict) and install a Cloudflare Origin Certificate on the server.

A valid certificate with a missing intermediate still fails on some devices:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com -showcerts

Install the full chain (fullchain.pem), not just the leaf certificate.

Our scans warn you 14 days before a certificate expires, and the Cert Chain Debug tool shows exactly which link in a chain is broken.

Check your fix

Common mistakes

Renewing the certificate but not reloading the web server, so the old one keeps being served.
Serving only the leaf certificate without the intermediate.
Using a certificate from a distrusted CA (for example eMudhra after Oct 27, 2026).