An expiry warning is a clue about a connection, not yet a diagnosis of your renewal job. First identify the exact hostname and certificate involved. Then find the person or service responsible for that endpoint. This sequence applies whether you use managed hosting, a CDN or your own web server.
If you are a visitor, stop at the warning and contact the site owner through a trusted channel. The steps below are for someone authorized to manage the website. Bypassing the warning does not repair the connection.
Record the symptom before changing settings
Note the full hostname, the browser’s exact error, when it happened, and whether it affects another current device or network. Check the affected device’s date and time: an incorrect clock can produce a certificate date error. Chrome’s error guidance distinguishes clock-related failures from other certificate problems.
Inspect the certificate details through the browser’s connection information or developer security tools where available. Record the names, issuer, validity dates and a certificate identifier such as its serial number. Do not continue through a warning to submit account details. Chrome documents its security panel; exact menu labels vary between browsers.
Compare the observed dates with the correct current time, including the displayed time zone. Also check whether the error names the website certificate or another certificate in its chain. A chain issue needs its own investigation even when the leaf certificate is recent.
Locate the endpoint serving that certificate
Work outward from what the visitor reaches. Is DNS intended to point to the host directly, a load balancer or a CDN? Match the observed certificate with the appropriate provider dashboard or server configuration. Do not assume a certificate visible in a hosting account is the one the browser receives.
When a CDN is involved, its browser-facing certificate and the origin’s certificate are separate. An expired origin can cause a CDN error even while the browser’s connection to the edge has a current certificate. Cloudflare’s documentation illustrates those two connections. Use your own provider’s error details to identify which side failed.
Was renewal missed, or was deployment missed?
For managed hosting, check the custom domain’s certificate status and recent renewal events. Escalate with the hostname, observed certificate dates and relevant error. Ask whether the service has issued a replacement and whether it has reached the affected endpoint.
For a self-managed client, inspect the last scheduled attempt and its logs. If no replacement exists, investigate the reported validation, permission, account or scheduling failure. Use the client’s documented recovery procedure after resolving the cause. Avoid starting several competing issuance processes.
If a replacement already exists, follow its installation path. Check whether the service references the intended certificate, whether activation completed, and whether every node received the update. Certbot’s renewal documentation distinguishes successful renewal actions from a run that had nothing to renew. A success message needs context.
Restore service and verify the public result
- Have the responsible provider or operator complete the documented renewal and deployment process.
- Recheck the same hostname and inspect the certificate now served.
- Compare its names and validity dates with the intended replacement.
- Check other affected hostnames and relevant serving paths.
- Confirm the original browser failure is resolved without weakening certificate checks.
If different visitors still receive different certificates, record their observed identifiers and routing context. Investigate stale endpoints or uneven deployment rather than declaring recovery from one successful page load. A newly issued local file is evidence of issuance, not complete restoration.
Close the incident with a small process change
Record the failed stage, the repair owner and the observation that confirmed recovery. Add monitoring of the served certificate and an alert route that someone checks. Include hosting and DNS changes in future renewal reviews. The renewal planning guide turns those lessons into a repeatable handoff.