How to fix certificate expiry and chain errors
An expired or incomplete certificate shows visitors a full-page warning. Automate renewal and send the full chain.
Step by step, with screenshots: What is an SSL certificate? Inside the file →
Check your own site
Runs these 2 checks and the other 191, free, in about 45 seconds.
Or run only this check with the free SSL checker.
What it is
A TLS certificate, still often called an SSL certificate, proves to browsers that your server really belongs to your domain and makes HTTPS possible. It has a fixed expiry date, and browsers must be able to follow the chain from your certificate through one or more intermediate certificates to a root they trust.
When a certificate expires, or the server leaves out an intermediate, visitors see a full-page "Your connection is not private" warning instead of your site, and most leave. Certificates are getting shorter: Let's Encrypt issues 90-day certificates, and the maximum for public certificates dropped from 398 to 200 days in March 2026, on its way to 47 days in 2029. getReport warns when expiry is close and fails the check when the chain does not validate.
What a passing site looks like
- The TLS certificate chain validatesfail · −12 ptseffort M
- Certificate expiry: passeswarning · −4 ptseffort S
1. The TLS certificate chain does not validate
Why it matters. Browsers cannot verify who issued the certificate, so visitors see "Your connection is not private" instead of your page. The usual causes are a missing intermediate certificate, an expired certificate or a name mismatch.
- Install the full chain (your certificate plus the intermediate) that your certificate authority provides, not just the leaf.
- Check that the certificate covers exactly this hostname, with and without www.
2. Certificate expiry
Why it matters. When the certificate expires, every browser shows a full-page warning and most visitors leave. Automatic renewals fail silently more often than you would expect.
- Renew the certificate now; with Let's Encrypt, run certbot renew and check the auto-renew job's logs.
- Add a monitor so you get an email 14 days before the next expiry.
Questions people ask
How do I monitor SSL certificate expiration?
Rely on automatic renewal first: Let's Encrypt clients, most hosts and CDNs renew certificates well before they expire. Then monitor from outside, because renewals fail silently when DNS, firewall or validation settings change. An external uptime or certificate monitor that alerts you 14 to 21 days ahead gives you time to act, and a getReport run shows the days left.
How long is an SSL certificate valid?
Public certificates issued since 15 March 2026 are valid for at most 200 days, and Let's Encrypt certificates for 90 days. The limit keeps shrinking under a 2025 CA/Browser Forum vote: 100 days from March 2027 and 47 days from March 2029. That makes automatic renewal essential; renewing by hand once a year no longer works.
What happens when an SSL certificate expires?
Browsers stop trusting the connection and show a full-page warning such as "Your connection is not private" with NET::ERR_CERT_DATE_INVALID. Most visitors leave, and with HSTS enabled they cannot click through at all. API clients, payment callbacks and mail servers that use the certificate may fail too. Nothing recovers until a new certificate is installed.
Why do SSL certificates expire?
Expiry limits the damage if a private key is stolen or a certificate was issued by mistake, and it forces sites to pick up newer, stronger settings. The CA/Browser Forum, where browsers and certificate authorities agree the rules, sets the maximum lifetime, which is shrinking in steps to 47 days by 2029. Shorter lifetimes make automated renewal essential rather than optional.