Magento SSL certificate expired

Magento ssl certificate expired stops checkout, admin login, and payment redirects—the storefront PHP is fine, but browsers refuse the TLS handshake on your store hostname.

Merchants run Magento Open Source behind nginx, Varnish, or AWS ALB. Certificate material often renews on a bastion while the load balancer listener still serves last year’s ARN.

Prove expiry on www.yourstore.com from outside the data center before you reindex or disable modules.

First response

Record the customer-visible URL, payment provider callback hostnames, and whether failure is desktop-only or also mobile apps calling your REST API. Screenshot the browser certificate viewer notAfter field.

Run openssl against both storefront and admin.yourstore.com if you split hosts. Export Magento Stores → Configuration → General → Web base URLs—but treat them as secondary until live TLS is verified.

Capture Varnish or CDN settings: many magento ssl certificate expired incidents are expired origin certificates behind a still-valid edge cert. Note Magento version (2.4.x) only for cache purge commands later.

Export inventory of integration hostnames from core_config_data (PayPal, Braintree, Klarna return URLs). Those endpoints must stay reachable over valid TLS for async notifications during checkout recovery. If you use Magento Cloud (Adobe Commerce on cloud), pull the Platform.sh or Fastly certificate expiry from their dashboards in addition to origin checks.

What this error means

Magento does not terminate TLS inside PHP-FPM for typical deployments. nginx, Apache, or a load balancer presents the certificate. When that leaf expires, customers see privacy errors; admin users cannot reach /admin to fix catalog data during peak season.

Secure base URL settings (web/secure/base_url) tell Magento to generate HTTPS links. They do not extend certificate lifetimes. If admins temporarily set insecure URLs during an incident, mixed-content and cookie scope issues persist after TLS recovery unless you purge generated static content.

Multi-store setups map hostnames to websites; each storefront hostname needs a matching SAN on the listener certificate.

Common causes

Certbot renews on the origin nginx node, but Varnish or HAProxy in front still mounts the old PEM. AWS ALB certificate manager imports expire when teams forget to reupload reissued bundles.

Staging certificates copied to production listeners during a hurried launch expire together six months later. Magento cron and async consumers calling https://yourstore.com with strict TLS fail quietly while the homepage looks fine through a CDN.

Over-aggressive web/secure/offloader_header or proxy SSL flags without updating the actual terminator confuse debugging—always openssl the public name. Page cache (Varnish, Fastly, FPC) does not fix TLS but hides admin errors until checkout POST runs.

Headless storefronts using GraphQL may call https://yourstore.com/graphql from server-side Node while shoppers see a CDN domain with separate cert inventory—one hostname expiring does not imply the other is healthy. Adobe Commerce B2B shared catalogs sometimes expose separate admin URLs on partner VPN; validate those hostnames in openssl even when the consumer site looks fine.

Confirm from the outside

echo | openssl s_client -connect www.yourstore.com:443 -servername www.yourstore.com 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer -serial

Repeat for admin host and any media. or static. subdomains customers hit directly.

curl -vI --connect-timeout 15 https://www.yourstore.com/checkout/ 2>&1 \
  | grep -Ei 'expire|SSL certificate|subject:|issuer:'

From the server (paths vary by install):

mysql -e "SELECT path, value FROM core_config_data WHERE path LIKE 'web/%base_url%';"
bin/magento config:show web/secure/base_url

How to read the output

Expired notAfter on the leaf confirms the incident is TLS, not GraphQL schema drift. Subject SAN must include the hostname in the browser bar. If edge openssl is fresh but origin openssl (to the upstream IP with correct SNI) is stale, fix the origin listener—see CDN edge OK but origin certificate expired.

Browser spot-check

Magento admin uses form keys and session cookies scoped to the admin domain—privacy errors block both. Compare customer-facing product page padlock with admin login; split host setups often renew only one listener.

Fix checklist

Work this list in order for Magento SSL certificate expired. Capture command output after each step so finance and support can align on when checkout was actually restored.

1. Renew or reissue the certificate on the terminating load balancer or web server.
2. Reload nginx/Apache/Varnish backends per your runbook; recycle PHP-FPM if local TLS termination.
3. Confirm web/secure/base_url and web/unsecure/base_url use https:// where appropriate (bin/magento config:set or admin UI).
4. bin/magento cache:flush and purge Varnish/Fastly/CDN.
5. Regenerate static content if mixed content lingers: bin/magento setup:static-content:deploy during maintenance window if needed.
6. Test checkout with a real payment sandbox and admin login from external network.
7. Re-run openssl; archive new serial in the change ticket.
8. Enable third-party monitoring on checkout URL specifically.

Roll out and verify

Treat Magento recovery as a commerce change window: notify payment partners if callback URLs were unreachable, and replay failed webhooks after TLS is healthy. Run a minimal order in each store view (B2B and B2C) with real carrier rate requests—those modules call external HTTPS endpoints that fail in parallel with storefront expiry.

Compare bin/magento setup:db:status only after admin is reachable; do not run destructive indexers while proxies still serve stale chains. If you use Redis or RabbitMQ over TLS, openssl those endpoints separately—ops dashboards often stay green while checkout POST dies on the public vhost.

Capture before/after openssl serial numbers for the load balancer ARN, origin nginx, and any WAF listener. Finance teams need timestamps proving how long checkout was broken; attach Grafana or New Relic request error rates if available.

When to use automation

Ecommerce teams notice expiry at checkout, not at homepage uptime pings. Monitor live TLS on checkout, admin, and REST https:// endpoints merchants use for integrations—see API clients failing on expired TLS.

Use /check immediately after renewal. Scheduled ssldays alerts at 30, 14, 7, and 1 day give time for OV revalidation or multi-region listener updates before Black Friday traffic.

Homepage uptime monitors that accept self-signed or expired certs during misconfiguration hide magento ssl certificate expired until payment capture fails. Monitor graphql, rest/V1/orders, and signed webhook URLs carriers provide. RDAP on the store domain prevents renewal surprises when OV or DNS-validation needs domain control.

See Ecommerce checkout down due to SSL expiry when symptoms concentrate on payment capture only.

Escalations for magento ssl certificate expired should attach external openssl on checkout, admin, and static hosts—not phpinfo screenshots. Inventory every hostname in core_config_data that starts with https:// and verify each independently. Partial fixes that renew only www leave B2B portals broken under separate base URLs.

Magento operators running Elasticsearch, RabbitMQ, or Redis over TLS should openssl those management endpoints during storefront incidents—search outages correlate with secondary cert expiry while checkout still loads cached catalog pages. Adobe Commerce Cloud teams must reconcile Fastly or Cloudflare dashboard expiry with origin listener dates; partners often renew one layer during a war room and declare victory while the other still serves stale chains.

Admin users with bookmarked http:// admin URLs may not notice TLS recovery until they clear HSTS pins in Chrome. Document whether your deployment uses nginx reverse proxy, Varnish full-page cache, or AWS ALB passthrough—renewal commands differ and runbooks should name the terminating product. Support macros that blame “Magento SSL module” mislead merchants; Open Source does not ship a substitute for valid server certificates.

Finance and support need aligned timestamps: note when cart abandonment spiked relative to notAfter. Post-incident, enable monitoring on payment return URLs PayPal and Adyen document in their dashboards—those paths are often omitted from hosting default vhost lists.

Long form post incident documentation for Magento merchants should list every payment method active during the outage and whether refunds or captures failed silently. Operations teams often discover expired TLS on the admin hostname first while the storefront still serves cached PLP HTML from a CDN. Security scanners and PCI auditors ask whether cardholder data ever crossed expired tunnels; your openssl timeline answers that question when logs are inconclusive.

Retail peaks around holidays make same day commercial certificate purchases tempting. Budget for automated DV renewal at the load balancer instead of manual annual purchases that depend on one person’s inbox. Train store managers that disabling HTTPS in Magento configuration is a temporary triage step, not a substitute for renewing the server certificate that browsers validate.

Partner marketplaces that pull Magento product feeds over HTTPS will pause synchronization until your public hostname presents a trusted chain again. Document which integrations failed during the window so account managers can replay missed catalog updates. Regional storefronts sharing one admin panel still need hostname coverage on every certificate presented to local shoppers. Customer service scripts should avoid instructing shoppers to disable security warnings; instead publish a status page as soon as external verification confirms expiry and estimated time to restore trusted TLS on the checkout hostname. Loyalty programs sending password reset links over email should delay sends until those links resolve with valid certificates on every store view domain. Wholesale buyers using punchout integrations over HTTPS need the same assurance before purchase orders resume flowing into ERP systems. Gift card balance lookups from mobile apps use the same storefront hostname and fail PKIX validation in tandem with browser checkout.