Renew the expired TLS certificate on Cloudflare

Why it matters

Browsers refuse to open a site whose certificate has expired and show visitors a full-page security warning. API clients and mobile apps fail outright, so the site is effectively down for them.

The fix

1. If the record for this host is Proxied (orange cloud), visitors get Cloudflare's edge certificate, not your server's. Open SSL/TLS then Edge Certificates and look at the certificate status and expiry.
2. For Universal SSL certificates, Cloudflare renews automatically. If the status is pending or shows a validation error, follow Cloudflare's Universal SSL troubleshooting. Typical causes are a CAA record that does not allow Cloudflare's CAs and DNS records that are not proxied.
3. If you uploaded a custom certificate, renew it at your CA and upload the new one. Custom certificates are never renewed for you.
4. If the record is DNS only (grey cloud), the certificate comes from your own server, so renew it there with the generic steps.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Install a certificate that covers this hostname
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject