Joomla SSL certificate expired

joomla ssl certificate expired stops administrator login, AJAX updates, and payment plugins until the web server certificate is current.

Joomla administrators encounter TLS warnings on /administrator or the public template when shared hosting or VPS TLS ages out.

Global Config Force HTTPS and configuration.php force_ssl/live_site amplify pain but do not cause expiry—renew the listener first.

Use hosting control panels or certbot on the box, then verify Joomla-specific settings.

First response

Check System → Global Configuration → Server → Force HTTPS. Note live_site in configuration.php.

curl -vI https://JOOMLADOMAIN/administrator/ 2>&1 | grep -Ei 'expire|SSL certificate'

Run hosting AutoSSL or provider renewal before toggling Joomla settings off as a workaround.

Screenshot Global Configuration Server tab and note SEF settings. List third-party extensions that inject https asset URLs. Check VirtueMart or payment plugin callback domains stored in extension config tables. Record which hosting panel user owns AutoSSL because agencies often troubleshoot Joomla before discovering reseller-level exclusions.

What this error means

Joomla issues redirects based on configuration, but PKIX still validates the certificate presented on port 443 first.

Extensions calling external APIs over HTTPS to your own domain fail with certificate errors identical to desktop browsers.

Multilingual domain aliases (example.de) need SAN coverage on the renewed cert.

Joomla Force HTTPS issues redirects only after TLS succeeds. Expired certificates stop users before Joomla reads configuration.php. CLI maintenance tasks over https fail with the same PKIX errors as browsers. Subdomain microsites for events share hosting certificates unless operators validate each DNS entry separately.

Common causes

Host AutoSSL failure on multi-site hosting.

Cloudflare Full (strict) with expired origin—edge may look fine.

Really Simple SSL-style plugins not applicable; Joomla uses core Force HTTPS.

Backup/migration restored old configuration.php pointing to https while cert missing.

Third-party CDN still serving HTTP-only to origin.

Backup restores often resurrect live_site https strings against expired hosting from snapshot date.

Confirm from the outside

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Replace HOST with the public hostname users type.

How to read the output

Test each language domain and bare www hostnames shoppers use.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

Joomla CLI (if installed)

php cli/joomla.php maintenance:globalcheck

After TLS fix, clear cache under System → Clear Cache.

Exercise SEF URLs and legacy index.php routes after renewal. Test multilingual domain switchers. Walk through administrator login, front-end checkout if present, and any API token issuance paths because each can hit different virtual hosts on shared hosting.

Fix checklist

1. Renew cert on host (AutoSSL, LE, or commercial).
2. Reload web server.
3. Set live_site to correct https:// URL.
4. Enable Force HTTPS only when openssl is clean.
5. Test admin login and extension updates.
6. Purge CDN/Cloudflare cache.
7. Fix mixed content via content or template settings if needed.
8. Monitor each domain alias.

Roll out and verify

Joomla extension updates over HTTPS fail closed when TLS is broken—complete infrastructure fixes before attempting extension manager installs, or you risk half-written files on disk.

With SEF URLs enabled, test both pretty routes and legacy index.php paths after renewal. Some .htaccess rules redirect to HTTPS before checking certificate validity.

Multilingual sites should verify each associated domain in language switchers, not only the default site language. K2 or VirtueMart storefronts may use additional subdomains needing SAN coverage.

After recovery, snapshot configuration.php permissions and backup hashes so a restore from old tape does not reintroduce https:// settings against expired hosting again.

Clear Joomla cache and purge CDN after TLS recovery. Snapshot configuration.php after successful validation. Retest administrator two-factor flows and extension update screens because both depend on stable https loops.

Retail associations running Joomla on shared HostGator or sibling hosts should tie TLS monitors to campaign landing pages, not only the corporate homepage. Joomla extension installer reaches github and update servers over HTTPS; TLS outages freeze security updates alongside frontend errors. Admin MFA plugins using external identity providers redirect across https hosts that all need valid certificates simultaneously. Session handlers configured for secure cookies strand users until TLS recovers—clear sessions after fix only if needed to avoid mass logouts during peak sales. Template frameworks like Gantry or T3 may hardcode protocol-relative URLs that break inconsistently across CDNs. Audit .htaccess in administrator directory separately from site root because some hosts duplicate force-ssl rules. When running Joomla behind Apache and nginx double proxies, renew the certificate on whichever proxy the internet hits first. Community event registration microsites on subdomains often miss AutoSSL when created manually in cPanel. Broadcast status pages should cite estimated recovery only after openssl on payment callback URLs succeeds, not merely when admin login works on office networks. Fire departments and municipal Joomla sites often rely on volunteers; publish a one-page renewal calendar tied to hosting panel dates so turnover does not drop institutional knowledge. After recovery, run accessibility scanners that fetch https assets to ensure auxiliary hosts serving fonts or PDFs also renewed. Associations running ticket sales through Joomla booking extensions should test payment callbacks from vendor sandboxes after openssl goes green. Document which htaccess file enforces https so consultants do not duplicate rules on the next migration. School districts publishing emergency PDFs over https should include those asset hostnames in the same incident until mobile parents confirm clean handshakes.

Volunteer-maintained Joomla sites should store hosting panel SSL screenshots in a shared drive with registrar renewal dates because leadership turnover otherwise rediscovers expiry every fiscal year. When municipalities syndicate press releases to partner domains, confirm each partner hostname in the same crisis bridge until every linked site passes external TLS validation. Retest contact forms that POST to https webhooks after AutoSSL succeeds. Capture screenshots of successful administrator login on guest networks for the ticket archive. Verify cron endpoints and feed URLs over https after hosting reload completes. Record the new certificate serial numbers on the closure checklist.

When to use automation

Certificate files on disk and green panels lie until a stranger's TLS handshake succeeds. Schedule live checks on the exact hostname shoppers or API clients resolve, including redirects and the certificate presented after your platform edge terminates the connection. Pair TLS notAfter with RDAP domain registration data so revalidation is not blocked by registrar billing.

Run a one-shot proof on /check, then add the production hostname to monitoring with alerts at 30, 14, 7, and 1 day thresholds. ssldays reads the live chain external users see—useful when shared hosting, PaaS edges, or CMS layers each claim TLS is fine.