An SSL certificate is only valid for a limited period. Renewing it in time avoids the browser warning, the loss of visitor trust and a service interruption. Here is how to track expiry, renew and monitor your certificates.
Tracking the expiry date
The end date appears on the certificate details and in your client area under SSL services. The included Let's Encrypt certificate is valid for about three months and renews automatically; paid certificates have a period set at order time. Note the expiry date as soon as you install: reminders sent by the certificate authority sometimes land in the spam folder or at an address nobody reads any more.
The included certificate and its renewal
On cPanel hosting, AutoSSL renews the Let's Encrypt certificate before it expires, with no action from you. Two conditions must remain true: the domain must still point to the hosting account, and HTTP or DNS validation must be reachable. If automatic renewal fails, check the DNS zone and then run AutoSSL again from cPanel. When in doubt, issue a new free certificate, which takes a few minutes.
Renewing a paid certificate
- Open the SSL service entry in your client area.
- Start the renewal or reissue before the expiry date.
- Answer the domain or organisation validation requests.
- Generate the new certificate request if the authority requires it.
- Install the new certificate.
Early renewal replaces the current certificate: the new end date is calculated from the new issuance. Plan the operation ahead rather than in the last days, so you keep time to fix a blocked validation.
Installing the new certificate
On cPanel, paste the new certificate, the intermediate chain and the private key where the previous ones were. On an nginx server, replace the files declared in the site block, test the configuration and then reload the service. Keep the old certificate and key for a few days in case you need to roll back, and check immediately that the padlock appears and the issuer is the right one.
Monitoring and receiving alerts
- Managed SSL option: our teams track the expiry date and handle renewal and installation.
- External monitoring: a probe that checks your domain's certificate reports an expired, soon-to-expire or badly installed certificate.
- Internal alerts: set a reminder threshold, for example thirty days before expiry, and send it to an address several people follow.
- Manual check: occasionally verify the chain and end date from a browser or a terminal.
A certificate you monitor once a year is not monitored: pick a monthly rhythm and test the alert once.
If the certificate has expired
An expired certificate cannot be reactivated: a new certificate must be issued. In an emergency, a free certificate installed immediately restores encryption, then you resume the paid certificate procedure. If you enable HSTS on the domain, remember that browsers then refuse to bypass the warning: the fix has to be fast.
