SSL certificate renewal-free and paid certificates

SSL certificates have an expiry date. An expired certificate causes browsers to show security warnings and may block users from accessing your site. The renewal process depends on whether you're using a free (Let's Encrypt) or paid certificate.

Let's Encrypt renewal (shared hosting)

On cPanel hosting with AutoSSL enabled, Let's Encrypt certificates renew automatically. AutoSSL checks certificate expiry daily and renews any certificate with fewer than 30 days remaining. You do not need to take any action.

To verify your certificate is auto-renewing: go to cPanel → Security → SSL/TLS Status and check the expiry date. If AutoSSL is failing, see the AutoSSL troubleshooting guide.

Paid certificate renewal

Paid certificates do not renew automatically-you must renew manually through your certificate authority (CA) before the expiry date. Most CAs send reminder emails 30, 14, and 7 days before expiry.

1. Log in to your CA's portal and initiate a renewal
2. Generate or re-use a CSR from cPanel → SSL/TLS
3. Complete the validation process (DV certs: verify domain; OV/EV: document submission)
4. Download the new certificate files from the CA
5. Install the renewed certificate in cPanel → SSL/TLS → Install and Manage SSL

Certificate already expired

If your certificate has expired, visitors see a browser security warning (NET::ERR_CERT_DATE_INVALID). Act quickly:

• For Let's Encrypt on shared hosting-run AutoSSL manually from cPanel → SSL/TLS Status → Run AutoSSL. A new certificate is usually issued within minutes if DNS is correct.
• For paid certificates-contact your CA and expedite the renewal. Install the new certificate as soon as it is issued.
• Emergency option-if the paid cert takes time, temporarily switch to Let's Encrypt by enabling AutoSSL for the domain, then switch back to the paid cert once renewed.

Renewal on VPS (Certbot)

On a VPS without cPanel, use Certbot to manage Let's Encrypt certificates. Certbot installs a cron job or systemd timer that auto-renews:

# Test that renewal would succeed
certbot renew --dry-run

# Force renewal now (useful for testing)
certbot renew --force-renewal

# Check status of all managed certificates
certbot certificates

Certbot's auto-renewal runs twice daily via the system timer. As long as port 80 is open and the domain resolves to your server, renewal is fully automatic.

Related articles