An expired SSL certificate usually needs to be renewed or reissued on the service terminating HTTPS. Do not assume that changing DNS or buying a new certificate is automatically the answer.
What the browser warning is telling you
An SSL/TLS certificate proves that the HTTPS connection is associated with the expected domain and is currently valid. An expired certificate can cause browser warnings, failed integrations and lost visitor trust even if the website files themselves are unchanged.
1. Identify which certificate is being served
Check the exact hostname that is failing: the main domain, www version or a subdomain. The certificate being served may come from the hosting provider, CDN, reverse proxy or another service rather than the registrar.
2. Check renewal and ownership
Find out whether the certificate was supposed to renew automatically. If automation failed, check whether the system still has permission to renew the domain and whether the DNS challenge or HTTP challenge can complete.
3. Check DNS and hosting together
If DNS was recently changed, the certificate renewal process may be reaching the wrong server. Confirm that the hostname resolves to the expected infrastructure and that the server can complete the renewal.
4. Test redirects and all important hostnames
Renewing one certificate does not guarantee every hostname is covered. Check both www and non-www behaviour, important subdomains and HTTP-to-HTTPS redirects.
5. Look for mixed content only after HTTPS is fixed
If the certificate is valid but the browser still shows security warnings, the issue may be mixed content—pages loading images, scripts or other resources over HTTP. That is a separate problem from certificate expiry.
Prevent the repeat
Record who owns the certificate process, how renewal works and where the HTTPS termination occurs. Automatic renewal is useful, but only if someone can see when it fails.