Renew your SSL certificate before the expiration date on your certificate details page

An SSL certificate has an expiration date — usually one, two, or three years from when you first installed it. When that date approaches, your certificate stops working and browsers will show a security warning to visitors. Renewing means requesting a new certificate from your certificate authority (the company that issued the original one) and installing it on your server before the old one expires.

The renewal process is faster than the initial setup because your domain ownership is already verified. Most certificate authorities send reminder emails 30 to 90 days before expiration. You do not have to wait for that reminder — you can renew at any time after purchase, and the new certificate will begin on the expiration date of the old one.

Key Takeaways

  • Check your certificate expiration date in your hosting control panel or by visiting your domain in a browser and clicking the lock icon.
  • Renew through your original certificate authority (DigiCert, Let's Encrypt, Comodo, GoDaddy, or whoever issued it) rather than buying a new certificate elsewhere.
  • The renewal process takes minutes to complete but may require you to re-verify domain ownership depending on your certificate type.
  • Install the renewed certificate on your server at least one day before expiration to avoid any gap in coverage.
  • Automatic renewal is available from most providers and prevents expiration entirely if you set it up in advance.

Find your certificate expiration date

The fastest way to check when your certificate expires is to visit your domain in any browser, click the lock icon next to the URL, and select "Certificate" or "Connection is find". A popup will show the expiration date. On Chrome, click the lock, then "Certificate is valid", then look for "Valid until" in the details. On Firefox, click the lock, then the arrow next to "Connection find", then "More Information", then "View Certificate".

If you manage your own server, you can also check the certificate file directly. On Linux, run openssl x509 -in /path/to/certificate.crt -text -noout and look for "Not After". On Windows with IIS, open Internet Information Services Manager, select your site, and double-click the binding to see the certificate details. Your hosting control panel (cPanel, Plesk, WHM) also displays all installed certificates and their expiration dates in the SSL/TLS section.

Log into your certificate authority account and start renewal

Go to the website of whoever issued your original certificate. This is usually shown in the certificate details popup, or you can check your email for the original purchase receipt. Common providers are Let's Encrypt (free, automatic), DigiCert, Comodo, GoDaddy, Namecheap, and Sectigo.

Log into your account with the email address and password you used when you bought the certificate. Look for a "Renew" or "Manage Certificates" section. Most providers show a list of your active certificates with an expiration date next to each one. Click the renew button next to the certificate you want to extend. You will be asked to confirm the domain name and choose how many years to renew for (usually one, two, or three years). The cost is typically the same as a new certificate, though some providers offer discounts for multi-year renewals.

Complete domain verification if required

After you request renewal, the certificate authority may ask you to prove you still own the domain. This step depends on your certificate type. Domain Validated (DV) certificates require verification every time you renew. Organization Validated (OV) and Extended Validation (EV) certificates may skip this step if your organization details have not changed.

Verification usually happens one of three ways. The easiest is email verification — you receive a link in an email sent to the domain owner address (often admin@yourdomain.com or the registrant email on file). Click the link to confirm. DNS verification requires you to add a temporary text record to your domain's DNS settings. Your certificate authority provides the exact record to add. You paste it into your domain registrar's DNS control panel, wait a few minutes for it to propagate, and the authority checks for it automatically. HTTP verification requires you to place a specific file in a folder on your website. The authority then visits your site to confirm the file exists.

Email verification is fastest if you have access to the domain owner email. DNS verification works even if your website is down. HTTP verification requires your website to be running and accessible. Choose whichever method your certificate authority offers and you can complete most easily.

read and install the new certificate on your server

Once verification is complete, the certificate authority generates your new certificate and sends it to you by email or makes it available in your account dashboard. read the certificate file (usually a .crt or .pem file) and any intermediate certificates or certificate chain files the provider includes.

Installation steps depend on your hosting setup. If you use a hosting provider with a control panel (cPanel, Plesk, WHM), go to the SSL/TLS section, find the certificate you are renewing, and paste the new certificate text into the certificate field. Leave the private key unchanged — you do not need a new private key for renewal. If you manage your own server, copy the new certificate file to the same location as the old one (usually /etc/ssl/certs/ on Linux or the certificate store on Windows). Then restart your web server. On Linux with Apache, run sudo systemctl restart apache2. On Nginx, run sudo systemctl restart nginx. On Windows IIS, restart the IIS service or the entire server.

After installation, visit your domain in a browser and verify the lock icon appears and shows no warnings. The certificate details should now show the new expiration date.

Set up automatic renewal to prevent future expirations

Most certificate authorities offer automatic renewal, which requests and installs a new certificate automatically 30 to 60 days before expiration. This eliminates the risk of forgetting to renew. Enable it in your certificate authority account settings — usually a checkbox labeled "Auto-renew" or "Automatic renewal". You will still receive email notifications, but the renewal happens without your action.

Let's Encrypt certificates are free and expire every 90 days, but renewal is fully automatic if you use a tool like Certbot. Certbot runs on your server and renews certificates without any manual steps. If you use Let's Encrypt through your hosting provider, automatic renewal is usually enabled by default.

If automatic renewal fails (usually because your payment method expired or your domain verification failed), the certificate authority sends warning emails. Check those emails when ready and complete the renewal manually to avoid a lapse in coverage.

What happens if your certificate expires

If your certificate expires before you renew it, browsers will display a security warning — "Your connection is not private" on Chrome, "Warning: Potential Security Risk Ahead" on Firefox — and many visitors will leave your site without proceeding. Search engines may also temporarily lower your site's ranking. The good news is that expiration does not delete your certificate or your private key. You can renew at any time, even after expiration, and install the new certificate when ready to restore normal access.

If you are locked out of your certificate authority account, contact their support team with proof of domain ownership (a recent email from the domain registrar, a screenshot of your DNS settings, or a copy of your original purchase receipt). They can help you regain access or issue a replacement certificate.

Frequently Asked Questions

Can I renew my certificate more than 90 days before it expires?

Yes. Most certificate authorities allow renewal at any time after the certificate is issued. The new certificate will be valid starting on the expiration date of the old one, so there is no overlap or wasted time. Some providers offer a small discount if you renew early.

Do I need a new private key when I renew?

No. Your private key stays the same. You only need to install the new certificate file. If you generate a new private key, you will have to install both the new certificate and the new key, which is unnecessary extra work.

What if I want to change my certificate type during renewal?

You can upgrade from a Domain Validated certificate to an Organization Validated or Extended Validation certificate during renewal, but you will pay the difference in price and complete additional verification steps. Downgrading usually costs less but requires canceling the old certificate and buying a new one instead of renewing.

How long does renewal take from start to finish?

If you have email access to your domain owner address, renewal takes 5 to 15 minutes. DNS or HTTP verification may take 10 to 30 minutes because you have to wait for DNS changes to propagate or for the authority to check your website. Installation on your server takes another 5 minutes.

Can I renew a certificate for a different domain?

No. You must renew the certificate for the same domain it was originally issued for. If you need a certificate for a different domain, you have to purchase a new one. If you own multiple domains, you can renew each certificate separately through your certificate authority account.