An expired certificate produces a full-page browser warning that stops visitors before they reach your site, and it looks alarming even to people who trust you. This guide covers how renewal works for the free automatic certificate, how to renew a paid one before it lapses, when you need a reissue rather than a renewal, and what to do if a certificate has already expired.
Checking what you have and when it expires
Three quick ways:
- Client area - open the domain from My Domains. The Overview shows SSL Status, Issuer Name, Start Date and Expiry Date.
- cPanel - Security → SSL/TLS Certificates → SSL/TLS Status lists every domain and subdomain with its certificate state.
- Browser - click the padlock and view the certificate details.
Or from a terminal:
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com < /dev/null 2>/dev/null | openssl x509 -noout -datesRenewal versus reissue
These are different operations and confusing them wastes days.
| Renew | Reissue | |
|---|---|---|
| Purpose | Extend the certificate for another term | Replace the current certificate within its existing term |
| Costs | A new term's fee | Normally free |
| Use when | Expiry is approaching | The private key was lost or exposed, you moved server, or the covered names need to change |
You need a reissue if
- You regenerated the CSR or private key in cPanel - the certificate no longer matches the key.
- The account was migrated to a different server and the key did not come with it.
- You need to add or remove a hostname, such as adding
wwwthat was left off. - The private key may have been exposed - committed to a repository, emailed, or on a compromised machine.
Renewing a paid certificate
- Start at least two weeks before expiry. DV issues quickly, but OV and EV involve human verification that can take days.
- Order the renewal from the SSL store, or pay the renewal invoice if one was generated.
- Generate a fresh CSR in cPanel under Security → SSL/TLS Certificates. Good practice is a new key pair at each renewal.
- Submit the CSR and complete validation - email, DNS or file, as before.
- Install the new certificate and its CA bundle under Manage SSL sites.
- Verify in a browser, and check on a phone as well to catch a missing CA bundle.
Re-running AutoSSL for the free certificate
If the automatic certificate has not renewed, something is blocking validation rather than the renewal itself failing.
- Open Security → SSL/TLS Certificates → SSL/TLS Status in cPanel.
- Tick the affected domains.
- Click Run AutoSSL.
- Read the result on the same page - it states the reason for any failure.
The usual causes are the domain no longer resolving to your server, a redirect intercepting /.well-known/acme-challenge/, or a CAA record naming a different authority.
If the certificate has already expired
- Do not tell visitors to click through the warning. It trains them to ignore exactly the warning that protects them.
- Check SSL/TLS Status and run AutoSSL - for a free certificate this often resolves it within minutes.
- For a paid certificate, order the renewal immediately. There is no grace period; expiry is instant and absolute.
- If you need the site reachable urgently and the paid renewal will take days, ask us about issuing the free certificate in the meantime. It is a valid, trusted certificate and removes the warning today.
- Once resolved, set a calendar reminder for a month before the next expiry.
Troubleshooting
| Symptom | Cause and fix |
|---|---|
| Free certificate stopped renewing | The domain no longer resolves to us, or a redirect blocks validation. Confirm DNS, then re-run AutoSSL and read the failure reason. |
| Renewed and installed, browser still shows the old certificate | Browser or CDN caching. Test in a private window; if you use a CDN, purge its cache. |
| "Certificate does not match the private key" | The CSR was regenerated after ordering. Request a reissue against the current CSR - reissues are normally free. |
| Renewal validation email never arrived | The approver mailbox does not exist. Create admin@yourdomain.com in cPanel, or switch to DNS validation. |
| Certificate valid on the main domain, expired on a subdomain | They are separate certificates. Check every entry in SSL/TLS Status, not just the main domain. |
| Expired certificate after moving hosting to us | The old certificate's key stayed behind. Either request a reissue from the original authority, or simply let our free certificate issue. |
| Mail client warns about the certificate but the website is fine | The mail hostname is not covered. Use the server hostname from Connect Devices as your mail server name. |
Frequently asked questions
How long are certificates valid?
Publicly trusted certificates have had steadily shorter maximum lifetimes for years, which is precisely why automatic renewal matters. The free certificate handles this for you; a paid one needs a diary entry.
Will I be warned before a paid certificate expires?
Renewal invoices and reminders are sent to your account contacts, so keep them current in Manage Contacts. Add your own calendar reminder as a backstop.
Is a reissue free?
Normally yes, within the certificate's existing term. The authority's own policy governs it.
Do I lose the remaining time when I renew early?
Most authorities carry unused time across, though the exact treatment varies. Renewing a couple of weeks early is safe and sensible.
Can I switch from a paid certificate back to the free one?
Yes. Let the paid one lapse or remove it, and AutoSSL will issue a free certificate once nothing else is installed for that domain. Open a ticket if it does not pick up automatically.
Does an expired certificate mean my site was hacked?
No. It only means the certificate reached its end date. The warning is precautionary, though visitors will not know that.
