Expired certificate: the five-minute version

An expired certificate is a reissue problem, not a reboot problem. Your visitors see a browser warning because the leaf certificate on the site has passed its end date, so AutoSSL did not renew in time or a paid certificate sat past its calendar date. You fix DNS or port 80 if the robot failed, then retry AutoSSL, or you paste a paid certificate in SSL/TLS if you already have one. Rebooting a VPS will not refresh SSL, and waiting another few days will not help once the dates are already dead.

Confirm the certificate is actually expired

Before you change anything, check the dates on the live handshake so you know you are solving the right issue.

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

If notAfter is in the past, the certificate is expired and AutoSSL already failed or was never in play. If the dates are still valid and browsers still warn, you likely have a name mismatch or a chain problem instead of this case. Open SSL/TLS Status in cPanel and read the plain-English reason next to the domain. That message tells you whether DNS, HTTP validation, or something else blocked the last attempt.

Work through the five-minute path

Put DNS on the correct nameservers or A record so the hostname resolves here. Keep port 80 open for HTTP-01 validation, and make sure any CAA record allows letsencrypt.org. Then run AutoSSL again from SSL/TLS Status so Let’s Encrypt can issue a fresh certificate on your cPanel account.

If you already have a paid certificate in email, install it under SSL/TLS now. That clears the interstitial while AutoSSL catches up on HTTP-01. Do not purge random TLS objects at a CDN; the certificate lives on the origin handshake. Only purge a cached error page if the CDN stored the warning HTML itself.

After the new certificate is live

Some clients cache the failure interstitial. Ask the visitor to close the tab fully and open a fresh one; Safari is especially stubborn about this. You do not need to reinstall an operating system or reboot the server for that cache to clear.

Default vhost mix-ups can look similar in a browser, with a scary page and the wrong name, but openssl will show another account’s subject. That is an SNI routing issue, not expiry. Check the certificate subject before you reissue something that is not the hostname they actually hit.

If AutoSSL is rate-limited, a paid DV certificate pasted into SSL/TLS is the practical short cover. Turn AutoSSL off for that name until the limit lifts so the robot does not fight the manual install. Note the new expiry date you just installed, and remember that a CDN only needs a purge of cached warning HTML, not a blanket “all SSL” flush.