Key Takeaways<\/strong><\/p>\n\n\n\n Under the hood, SSL certificates are just small digital files that contain some basic information. Most importantly, they hold: a public key (one half of a cryptographic key pair used for encrypting data), a digital signature created by a certificate authority that issues the certificate to verify its authenticity, details about the domain or organization the certificate is issued to, information about the cryptographic algorithms used, and lastly a mention of the validity period of the certificate.<\/p>\n\n\n\n As you can see, there’s nothing too fancy inside an SSL, but somehow this is all that’s needed to make the communication between your site and its visitors secure. Still, given that SSL certificates are actually just simple text files, there isn’t much that any web browser can do with them other than read what’s inside and decide if the contents is still valid.<\/p>\n\n\n\n For that reason, as soon as the validity period coded into the certificate expires, the whole certificate is rejected and web browsers will inform your readers of this in a quite dramatic manner. This can be pretty problematic for you, since not a lot of visitors will soldier through when they see a notice like this:<\/p>\n\n\n Okay, so why do those things have to expire? Can’t they stay valid forever?<\/em> I hear you, but here’s the thing:<\/p>\n\n\n\n SSL certificates expire for a few good reasons:<\/p>\n\n\n\n In the end, expiring SSL certificates are simply something that all website owners have to deal with from time to time.<\/p>\n\n\n The biggest problem with certificates going expired is that Google and all the leading web browsers will insist heavily that the user should not visit such websites. Your visitors seeing a warning like the one in the image above creates a lot of side problems that can spin out of proportion pretty quickly:<\/p>\n\n\n\n These are just a few reasons why keeping your SSL valid or renewing it when the time’s up is crucial!<\/p>\n\n\n Back in the day, when SSL-ifying<\/em> websites was still pretty novel and SSL certificates were expensive, it wasn’t uncommon for certificates to stay valid for three to even five years. Since you had to configure them each time purely by hand, it was simpler to avoid that as much as possible and keep those periods as long as possible.<\/p>\n\n\n\n It was a convenient approach for sure, but not optimal from a security standpoint. This kept evolving over the years, and at some point stopped at “two years” to be a common validity period for SSLs. However, as of September 2020, the recommended issuing period was shortened again to roughly 13 months<\/a>, which was a significant reduction compared to the previous standards.<\/p>\n\n\n\n These days, some certificates last for up to those 13 months (or 398 days exactly), whereas others have expiry dates as low as 90 days (we’re looking at you Let’s Encrypt<\/a>). For many, these expiration dates can be a hassle. One reason the certificate authorities argue that shorter validity periods are necessary is to encourage automation and actually free users of having to worry about renewals entirely.<\/p>\n\n\n\n A lot of web hosts and certificate authorities enable you to automate the renewal process already. It should arguably become the new standard, so we get to enjoy the security benefit of short certificate validity periods without having to process renewals manually.<\/p>\n\n\n Since you’re reading this, you might have received an email similar to the following:<\/p>\n\n\n Or maybe like this one – a bit more dramatic:<\/p>\n\n\n The first order of business is not to be super-alarmed at this point. The fix is actually not that difficult and nothing bad has happened yet.<\/p>\n\n\n\n Here’s where you can start:<\/p>\n\n\n If you’re not familiar with Let’s Encrypt, it is a free, automated certificate authority launched in 2016 with the main purpose of promoting widespread use of SSLs. It simplifies the process of getting SSL certificates, automating most of it. This ease of use, combined with their certificates being 100% free, has quickly made Let’s Encrypt the most popular choice among website owners and hosts, and it has boosted the adoption of HTTPS across the web significantly.<\/p>\n\n\n\n Chances are that if you’re on an entry-level hosting, and you do have an SSL certificate with it, then that certificate is most likely from Let’s Encrypt.<\/p>\n\n\n\n \ud83d\udc49 Another perk of having an SSL certificate from Let’s Encrypt is that they will also auto-renew<\/strong>. And the best part is that every host that integrates with Let’s Encrypt does support this auto-renewal feature for their certificates.<\/p>\n\n\n\n To check if your current SSL is from Let’s Encrypt, you can go to cPanel<\/a>, into SSL\/TLS Status<\/strong>, and click on View Certificate<\/strong> next to your domain name:<\/p>\n\n\n On the next page, you will see this among the certificate details:<\/p>\n\n\n If it says “Let’s Encrypt” there, then you can ignore the rest of this guide, your certificate will renew automatically.<\/p>\n\n\n\n If you’re not sure either how to access cPanel or if your certificate is from Let’s Encrypt, your best bet is to contact the hosting support and ask them.<\/p>\n\n\n If your certificate doesn’t come from Let’s Encrypt, this still doesn’t mean that you won’t be able to have it auto-renew. <\/p>\n\n\n\n Many popular hosts automate renewals of all their SSL certificates so that you don’t have to deal with them at all. <\/p>\n\n\n\n \ud83d\udd25 Here’s a list of some of the top-tier most popular hosts that offer automated SSL renewals already: SiteGround, WP Engine, IONOS, DreamHost, Flywheel, Kinsta, InMotion, A2 Hosting, Hostinger, HostGator, Namecheap, GoDaddy. If you host with any of them, you can expect that your certificate will be auto-renewed when it’s closer to its expiration date (usually around the 14-day mark).<\/p>\n\n\n\n \ud83d\udca1 If you host with Bluehost, whether your certificate renews automatically depends on the plan you’re on. Another factor that might come into play is the type of your SSL – free or premium. Some users report their free SSLs require manual renewals while others say they renew automatically with no problems.<\/p>\n\n\n\n For example, in the case of our test website on Bluehost (the one we use to monitor web host performance<\/a>), its certificate has been renewing automatically every year on its own. To check if the situation is the same for you, go to your Bluehost dashboard, into Hosting<\/strong>, Security<\/strong>, and then View SSL Logs<\/strong>.<\/p>\n\n\n This will land you in cPanel. See if there’s a label that says that your certificate will renew automatically:<\/p>\n\n\n If yes, then you can ignore the rest of this guide. <\/p>\n\n\n\n Again, if you can’t find any of these details in your hosting panel, your best path forward is to contact the support chat and ask about whether your SSL certificate will renew automatically or if you have to do something about it. <\/p>\n\n\n\n While you’re at it, ask them how to enable auto-renewals if possible on your setup. <\/p>\n\n\n\n That being said, if you don’t have the option to automate the process, you’ll want to know how to renew your SSL certificate manually. Below, I present the most common method that works with all web hosts based on cPanel (a big majority of them):<\/p>\n\n\n The process for renewing your SSL certificate may vary a bit depending on what web host or certificate authority you’re using. Even so, the big picture remains the same. You’ll need to: (1) generate a certificate signing request (CSR), (2) get a certificate from a certificate authority, (3) install it on your hosting setup.<\/p>\n\n\n\n For illustration, I’ll show you how to go through a manual SSL certificate renewal using a standard cPanel<\/a> hosting setup. Most web hosts use this management tool, so it should be fairly universal advice that you will be able to recreate on your setup.<\/p>\n\n\n The first thing you need to do is generate a CSR from your web host, which validates your server’s identity. <\/p>\n\n\n\n A CSR (Certificate Signing Request) is like a digital application form for an SSL certificate. When a website wants to get a security certificate, it creates this special file containing information about the site and its owner, along with a unique code. Next, this file is sent to a certificate authority, which then uses the information in the CSR to create and sign the SSL certificate.<\/p>\n\n\n\n If your hosting provider uses cPanel, you can do this by navigating to the Security<\/strong><\/em> tab and looking for the SSL\/TLS<\/strong><\/em> option:<\/p>\n\n\n On the next screen, go for the link under Certificate Signing Requests (CSR)<\/em><\/strong>:<\/p>\n\n\n On the next screen, you’ll see all your currently generated SSLs, and, at the bottom, you can generate a new CSR for any of your existing domains:<\/p>\n\n\n Do note that you’ll need to provide contact information to validate domain ownership. Once you fill out every field, your host will provide you with a CSR code. It’s going to look something like this:<\/p>\n\n\n Keep this code handy because you’ll need it to re-activate your certificate.<\/p>\n\n\n The certificate authority is a company that will issue the SSL to you. If your SSL is not from Let’s Encrypt, then other popular options include DigiCert<\/a>, Comodo<\/a>, SSL.com<\/a>, GlobalSign<\/a>.<\/p>\n\n\n\n The next step is taking your generated CSR and submitting it with the certificate authority of your choosing. The exact steps of this process will depend on the specific company. Generally, though, you will need to follow the prompts and provide all the requested information, along with your CSR.<\/p>\n\n\n\n You’ll walk out on the other side with a fresh SSL certificate that’s ready to be installed on your current hosting. <\/p>\n\n\n Installing SSL certificates changes from host to host, but you can generally follow these steps:<\/p>\n\n\n\n Go to cPanel \u2192 SSL\/TLS<\/strong>, and pick Manage SSL sites<\/strong> from the options available:<\/p>\n\n\n From there, you can upload the certification files provided to you by the certificate authority. In most cases, you will need these two:<\/p>\n\n\n Click on Install Certificate<\/strong> when done. If you’re lucky, that’ll be the last time you have to renew your SSL certificate by hand!<\/p>\n\n\n\n Bluehost does use cPanel underneath its main hosting panel, but certain details sometimes work a bit differently. The fastest way to find the screen that allows you to upload a new certificate is to go to your main dashboard, then to Hosting<\/strong> \u2192 Security<\/strong>, and click on Upload SSL<\/strong>:<\/p>\n\n\n This will take you to a cPanel setup where you will be able to copy your SSL details into this field:<\/p>\n\n\n Click on Save Certificate<\/strong>.<\/p>\n\n\n Having an SSL certificate is a must these days for modern websites. Not using the protocol can affect your search engine optimization and, more importantly, put your users’ data at risk. Luckily, getting and installing an SSL certificate is rather simple (and it can also be cheap), so there’s no excuse not to do it.<\/p>\n<\/div>\n\n\n\n However, the renewal process for SSL certificates can be confusing at first, and it depends highly on which certificate authority created the certificate for you.<\/p>\n\n\n\n Do you have any questions about how to renew SSL certificates? Let’s go over them in the comments section below!<\/strong><\/em><\/p>\n\n\n\n
Can SSL certificates actually expire?<\/h2>\n\n\n\n
![\"SSL](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/SSL-expired-notification.png\")
<\/figure><\/div>\n\n\n\n
What happens when your SSL expires<\/h3>\n\n\n\n
\n
When SSL certificates commonly expire<\/h3>\n\n\n\n
What to do when you get an SSL expiration email\/notice?<\/h2>\n\n\n\n
![\"An](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2019\/11\/renewal-notice.png\")
<\/figure><\/div>\n\n\n![\"SSL](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/SSL-expiry-notice.png\")
<\/figure><\/div>\n\n\na) Check if your certificate is from Let’s Encrypt<\/h3>\n\n\n\n
![\"View](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/autossl.png\")
<\/figure><\/div>\n\n\n![\"let's](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/lets-encrypt-details.png\")
<\/figure><\/div>\n\n\nb) Check if your web host offers automated SSL renewals<\/h3>\n\n\n\n
![\"Bluehost](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/Bluehost-see-SSL-status.png\")
<\/figure><\/div>\n\n\n![\"your](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/autossl-2.png\")
<\/figure><\/div>\n\n\nHow to renew SSL certificate (in just 3 steps)<\/h2>\n\n\n\n
Step #1: Generate a new CSR<\/h3>\n\n\n\n
![\"cPanel](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/cPanel-SSL-TLS.png\")
<\/figure><\/div>\n\n\n![\"CSR](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/CSR-request.png\")
<\/figure><\/div>\n\n\n![\"generate](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/generate-new-CSR.png\")
<\/figure><\/div>\n\n\n![\"CSR](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/CSR-code-example.png\")
<\/figure><\/div>\n\n\nStep #2: Submit CSR to a certificate authority of your choice<\/h3>\n\n\n\n
Step #3: Install your newly renewed SSL<\/h3>\n\n\n\n
For standard cPanel hosting:<\/h4>\n\n\n\n
![\"manage](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/manage-SSL-sites.png\")
<\/figure><\/div>\n\n\n![\"certificate](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/certificate-files.png\")
<\/figure><\/div>\n\n\nFor Bluehost:<\/h4>\n\n\n\n
![\"Bluehost](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/Bluehost-upload-SSL.png\")
<\/figure><\/div>\n\n\n![\"Bluehost](\"https:\/\/mllj2j8xvfl0.i.optimole.com\/cb:c5QE.37290\/w:auto\/h:auto\/q:mauto\/f:best\/https:\/\/themeisle.com\/blog\/wp-content\/uploads\/2024\/06\/Bluehost-SSL-save.png\")
<\/figure><\/div>\n\n\nConclusion<\/h2>\n\n\n\n
\n