Domain expired but SSL certificate still valid?

domain expired ssl valid describes a dangerous split screen: browsers still complete TLS while registrar entitlement to the name is already past due—HTTPS green does not mean the brand still owns the hostname next week.

Site owners, SEO leads, and on-call engineers often discover this during crawl audits or after finance missed a renewal invoice. The certificate was issued months ago with a distant notAfter; nobody opened the registrar portal because external uptime checks stayed green.

The usual mistake is treating a successful openssl handshake as proof the business is safe. Registration and TLS run on separate clocks. You will confirm registration state with RDAP, compare it to live TLS, and plan renewal before redemption fees or public deletion.

Marketing funnels that only watch uptime percent miss domain expired ssl valid until Search Console reports DNS failures or email DMARC stops aligning. Run both checks any time leadership asks whether HTTPS still looks fine after a billing dispute with the registrar.

What to check

Start with registrar domain expiration via RDAP, not the padlock icon. Look for status values such as redemptionPeriod, pendingDelete, or clientHold even when TLS still negotiates.

On the TLS side, read served notAfter, issuer, and SAN coverage from a public vantage—same hostname customers type. Cached certificates at a CDN can differ from origin; probe the URL users see.

Document apex registration separately from www TLS. Subdomains inherit the parent registration; an apex lapse eventually kills NS glue and ACME dns-01 validation even if a wildcard still decrypts traffic briefly.

Search engines care about availability and canonical HTTPS. A valid cert on a name sliding toward deletion risks sudden deindexing when DNS is parked or replaced—SEO teams should pair crawl stats with check domain registration expiry data.

Franchise and dealer networks amplify domain expired ssl valid risk: corporate IT renews the apex while local microsites use vanity hostnames on the same registration row. Dealer paid media keeps sending clicks to URLs that handshake successfully even though the registry clock already moved past expiration. Run RDAP on the registrable parent weekly for any campaign landing page, not only flagship properties.

Security teams should treat past-due registration as equivalent to impending certificate compromise for brand phishing. A dropped name can receive new DNS that still presents your old PEM until browsers pin caches expire, letting fraudsters harvest credentials without triggering certificate warnings.

Step-by-step

Confirm registration with RDAP

DOM=example.com
curl -s -H "Accept: application/rdap+json" "https://rdap.org/domain/${DOM}" \
  | jq '{name: .ldhName, status: .status, events: [.events[]? | {action: .eventAction, date: .eventDate}]}'

See RDAP lookup domain expiration for bootstrap details when rdap.org rate-limits bulk jobs.

Confirm live TLS on the public hostname

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
  | openssl x509 -noout -dates -issuer -subject

Compare timelines in one ticket

printf "REGISTRY\t%s\n" "$(curl -s -H "Accept: application/rdap+json" "https://rdap.org/domain/${DOM}" \
  | jq -r '.events[] | select(.eventAction|test("expir")) | .eventDate' | head -1)"
printf "TLS\t%s\n" "$(echo | openssl s_client -connect www.${DOM}:443 -servername www.${DOM} 2>/dev/null \
  | openssl x509 -noout -enddate | cut -d= -f2)"

PowerShell RDAP snapshot

$dom = "example.com"
$r = Invoke-RestMethod -Uri "https://rdap.org/domain/$dom" -Headers @{ Accept = "application/rdap+json" }
[PSCustomObject]@{ Status = ($r.status -join ","); Events = $r.events }

Escalate to registrar billing if expiration is in the past but TLS is future-dated—payment or redemption is the fix, not certbot alone.

How to read the output

When RDAP expiration predates today but openssl shows notAfter weeks ahead, the name is in grace or redemption depending on TLD policy. DNS may still resolve while registry timers count down; parked pages may appear before full deletion.

HTTP may return 200 from a successor registrant after drop—your old certificate becomes irrelevant even if notAfter has not arrived, because you no longer control DNS to serve it.

If status lists clientHold, TLS can succeed at an edge that has not yet synced, while email and new issuances fail. Treat any past-due registration as P1 for brand domains regardless of padlock color.

Crawl tools reporting mixed content or certificate name mismatches after expiry often reflect registrar parking injecting new HTML while TLS keys linger—do not dismiss SEO alerts as cosmetic.

Incident bridges should record both RDAP status screenshots and openssl transcripts in the same channel. When leadership asks whether HTTPS is fine, answer with two sentences: served notAfter, and nearest registration event. Mixed answers prevent teams from burning hours reissuing certificates while accounting still disputes a lapsed invoice.

After restore from redemption, expect crawlers to revisit slowly. Search Console may show valid HTTPS while coverage counts fall because parking HTML persisted during grace. Communicate recovery timelines to marketing before re-enabling large ad spend, even when openssl already looks pristine.

Common mistakes

Assuming Let's Encrypt auto-renew solves registrar lapse—it only renews while you still control validation records on the live zone.

Checking only internal monitoring that hits a load balancer with a stale uploaded cert while public DNS already points at a parking server.

Ignoring warehouse acquisitions: production certs on legacy brands stay valid until validation fails even when procurement forgot the apex renewal.

Publishing incident posts that blame SSL when RDAP clearly shows registration failure—confuses customers and auditors.

Delaying redemption payment because openssl still works until the fee doubles overnight per registry schedule.

When to use automation

domain expired ssl valid portfolios need paired alerts: live TLS thresholds and RDAP registration thresholds on the same hostname row. Manual quarterly spreadsheets miss the gap between clocks.

ssldays reads the certificate the internet sees and queries RDAP where registries publish expiry, emailing at 30, 14, 7, and 1 days for each signal. Slack and Discord webhooks ship on Starter and Pro after you schedule at /register. Free tier covers 3 domains daily; Starter 25 hourly; Pro 100 hourly.

Adopt domain and SSL expiry monitoring before a high-traffic campaign, not after finance admits an auto-renew card failure.