An expired SSL certificate produces browser warnings, breaks trust and costs traffic. Domainyze alerts you early, but the renewal itself happens with your certificate provider or web host. This page covers both the fix and the more confusing case: a certificate you renewed that is still reported as expired.
Renewing and installing
- Identify your certificate provider. Usually your web host, your registrar, or a dedicated provider such as Let's Encrypt, DigiCert or Sectigo.
- Log in to their control panel and find the certificate for the affected domain.
- Renew it. This normally means paying, if it is a paid certificate, and re-validating domain ownership by clicking an emailed link, adding a DNS record, or uploading a file to your server.
- Install the new certificate on the server. Many hosts do this automatically. If yours does not, you are updating the certificate, key and chain files in your server configuration.
- Restart or reload the web server. Apache, Nginx and IIS all serve the old certificate from memory until they are reloaded.
- Verify from outside. Use an independent checker such as SSL Labs, or the Domainyze SSL checker, to confirm the live site is presenting the new certificate.
- Refresh the domain in Domainyze to update its SSL status immediately rather than waiting for the next daily check.
Why it can still show as expired after you renewed
This is almost always one of four things, in this order of likelihood.
1. Renewal is not installation
Renewing generates a new certificate. Until it is installed, your server keeps presenting the old, expired one to every visitor and to every checker. This is by far the most common cause, and it is invisible from the provider's dashboard, which will happily show the new certificate as issued.
2. A CDN or proxy is serving the old one
If traffic passes through a CDN or proxy such as Cloudflare, that layer holds its own certificate and its own cache. Renewing at origin changes nothing until the edge is updated or its cache is purged. Whatever the public internet sees is what Domainyze sees.
3. The chain is incomplete
A certificate installed without its intermediate certificates validates in some clients and fails in others. Domainyze reports it as invalid, which is correct: a chain that only works in your browser is broken for a meaningful share of your visitors.
4. The check has not run yet
SSL checks run as a daily sweep. If you installed the certificate an hour ago, refresh the domain from its page rather than waiting.
Why an SSL alert may not have arrived
If you expected a certificate alert and did not get one, work down this list:
- SSL monitoring is off for that domain, or the domain is in your Watchlist rather than your Portfolio. SSL monitoring applies to domains you own, on a paid plan.
- No reminder windows are selected. With no windows chosen, there is nothing to send in advance. Choosing 90, 60 and 30 days is a good default.
- The certificate expired before a reminder window could fire. You will get the "certificate is invalid" alert, but not a pre-expiry warning that no longer had time to happen.
- Your server was unreachable at check time. If we cannot open a connection, we cannot read a certificate. That is recorded as a failed check rather than as a certificate problem.
- The alert was delivered but not seen. Check spam, and confirm your email address is verified in Settings. Troubleshooting: not receiving alerts covers the whole delivery path.
Preventing the next one
- Turn on SSL reminders for every Portfolio domain that serves a site.
- Enable auto-renewal with your provider where it is offered.
- Use short-lived, automated certificates. Let's Encrypt's 90-day certificates renew unattended, which removes the manual step that causes most expiries — provided the renewal is actually automated and the server is reloaded afterwards.
See also What is SSL monitoring and how it works for how the check itself runs, and How to monitor SSL for subdomains and wildcards.