Renew the expired TLS certificate on Netlify
Why it matters
Browsers refuse to open a site whose certificate has expired and show visitors a full-page security warning. API clients and mobile apps fail outright, so the site is effectively down for them.
The fix
- Open Domain management then HTTPS for the site and read the certificate status. Netlify provisions and renews Let's Encrypt certificates automatically.
- Check that the domain's DNS still points at Netlify. A changed or removed record stops renewal.
- If you have CAA records, they must allow letsencrypt.org.
- If you installed a custom certificate, it is not renewed automatically. Renew it at your CA and install it again, or switch back to the Netlify-managed certificate.
Related
- Reported by the certificate chain and expiry check
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Replace the self-signed certificate with a trusted one
- Use a certificate from a publicly trusted authority
- Serve the full certificate chain
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.