When a certificate expires, browsers show a full-page warning such as NET::ERR_CERT_DATE_INVALID and most visitors leave. The fix depends on the certificate: free AutoSSL certificates renew themselves unless something blocks them, while paid certificates must be renewed and installed by hand.
Before you start
- Check your computer's date and time. A wrong clock produces the same error for every site.
- Find out which certificate is installed: click the warning's details, or open cPanel → Security → SSL/TLS Status.
Free AutoSSL certificate expired
AutoSSL starts renewing well before expiry. If it failed, the reason is shown in cPanel.
- Open cPanel → Security → SSL/TLS Status.
- Find the domain and read the status text or the warning icon next to it.
- Click View log or the latest AutoSSL log to see the error.
- Fix the cause (see the table), then select the domain and click Run AutoSSL.
| Log message mentions | Cause | Fix |
|---|---|---|
| DNS does not resolve to this server | Domain or www points elsewhere | Update the A record or nameservers |
| DCV failed / HTTP validation | Validation file blocked by .htaccess, a redirect or a firewall | Allow /.well-known/ and remove broken redirects |
| CAA record forbids | A CAA DNS record allows only another CA | Add the AutoSSL provider to CAA or remove the record |
| Excluded | Domain excluded from AutoSSL | Include it again in SSL/TLS Status |
| Rate limit | Too many requests recently | Wait and run again later |
Paid certificate expired
- Renew the certificate with your certificate authority. Most CAs ask for a new CSR: generate one in cPanel → Security → SSL/TLS → Certificate Signing Requests.
- Complete validation again.
- Install the new certificate in cPanel → Security → SSL/TLS → Manage SSL sites, using Autofill by Certificate, and click Install Certificate.
- Check the expiry date shown after installation.
Need the site secure immediately while you wait for the CA? Remove the expired certificate in Manage SSL sites and run AutoSSL; a free certificate is issued within minutes if DNS points to the server. Install the paid one when it arrives.
Check the result
- Open the site in a private window and check the certificate's Valid to date.
- Test both
example.comandwww.example.com, plusmail.example.comif you use it in email clients. - Run an external SSL checker to confirm the chain.
Prevent it next time
- Keep DNS pointing to MdmHost for every hostname you want covered; most AutoSSL failures are DNS changes made elsewhere.
- Avoid redirect rules that send
/.well-known/requests to another domain. - Make sure the contact email in cPanel (Preferences → Contact Information) is current and that notifications for AutoSSL are enabled, so you hear about failures early.
- For paid certificates, set a calendar reminder 30 days before expiry, or use an uptime monitor that checks certificate expiry.
Troubleshooting
- New certificate installed but browsers still show the old one: clear the browser cache, or a CDN such as Cloudflare is serving its own certificate; check its SSL settings.
- Only some visitors see the error: their device's clock is wrong, or an old Android device does not trust the current root; this is on the visitor's side.
- Webmail or cPanel login shows an expired certificate: the server hostname certificate is a separate one; contact support.