PrestaShop SSL expired

Prestashop ssl certificate expired triggers browser warnings on the storefront and locks merchants out of /admin until the web server presents a valid chain again.

PrestaShop 1.7 and 8.x rely on Apache or nginx in front of PHP. The “Enable SSL” toggle in back office does not replace renewing the certificate on the terminator.

Verify live TLS on the shop URL customers use in ads, then align Shop Parameters with HTTPS.

First response

Note PrestaShop version, multistore setup, and whether you use a reverse proxy (Cloudflare, OVH front). Capture failing URL (https://shop.example.fr vs https://www...).

Back office may be unreachable—use hosting panel file manager or database read-only to confirm ps_configuration values for PS_SSL_ENABLED and domain settings if needed later.

Run openssl and curl from external network. Screenshot payment module callbacks (PayPal, Stripe webhooks) that hit your domain; they fail in parallel with browser errors.

PrestaShop multistore URLs live in ps_shop_url; export them before asking hosting to renew so you do not fix only the default shop. If modules call Tools::getShopDomainSsl(), stale cache can mislead you into thinking SSL is enabled while the listener cert is dead.

What this error means

PrestaShop generates links from Shop Parameters → Traffic & SEO and SSL settings. When the certificate on port 443 expires, nobody reaches PHP to change those values—recovery starts at the host certificate store or load balancer.

Partial enablement (SSL everywhere off, mixed HTTP assets) causes warnings after you fix dates until you clear cache and update .htaccess redirect rules. Multistore installations map several domains; each must appear on the presented certificate SAN list.

Common causes

Shared hosting auto-renewal breaks when domain validation paths change or .well-known is blocked by merchant-uploaded .htaccess rules.

FO modules force HTTPS without maintaining server cert lifecycle. Staging shop clones share production certificates that expire together. CDN edge valid while origin cert expired produces checkout POST failures only.

Merchant disables SSL in panic, leaving cookies split across schemes. Docker/k8s PrestaShop images mount TLS secrets updated in git but not in the ingress controller actually serving traffic.

European merchants using legal cookie banners sometimes embed http:// asset links in CMS pages; those warnings persist briefly after prestashop ssl certificate expired recovery until Smarty recompiles templates. Carrier pickup point APIs (Mondial Relay, DHL) negotiate TLS independently—logistics tabs fail while homepage loads.

Confirm from the outside

echo | openssl s_client -connect shop.example.fr:443 -servername shop.example.fr 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer -serial

curl -vI --connect-timeout 15 https://shop.example.fr/ 2>&1 \
  | grep -Ei 'expire|SSL certificate|subject:|issuer:'

If admin still loads on an alternate host, test it too. On server (with credentials):

grep -E 'PS_SSL|CANONICAL' /path/to/prestashop/app/config/parameters.php 2>/dev/null || true
mysql -e "SELECT name, value FROM ps_configuration WHERE name LIKE '%SSL%' OR name LIKE '%PS_SHOP_DOMAIN%';"

How to read the output

Past notAfter confirms TLS incident. If issuer is Let's Encrypt but dates old, renewal failed at host—see hosting panel. SAN must cover language-prefixed URLs if you use per-locale domains.

Browser spot-check

Test guest checkout and logged-in checkout separately—cookie secure flags behave differently. Mobile wallets redirect through bank apps that enforce stricter PKIX than desktop.

Fix checklist

Work this list in order for PrestaShop SSL expired. Merchants should snapshot ps_configuration SSL keys before editing production values.

1. Renew certificate at hosting panel, Plesk, or load balancer—same path as Magento SSL expired ecommerce flows.
2. Reload web server; verify openssl serial changed externally.
3. Shop Parameters → General → Enable SSL and “Enable SSL on all pages” when ready.
4. Update PS_SHOP_DOMAIN / PS_SHOP_DOMAIN_SSL via admin or SQL if hostnames changed (backup DB first).
5. Advanced Parameters → Performance → Clear cache; delete var/cache/prod if needed.
6. Test cart, carrier APIs, and back-office login on mobile data.
7. Reapply .htaccess HTTPS redirects from PrestaShop docs if you customized rules.
8. Monitor checkout URL, not only homepage.

Roll out and verify

PrestaShop merchants often run one-click upgrade modules and backup plugins—confirm their license servers and cron URLs over HTTPS after the public cert recovers. Test carrier modules (Colissimo, UPS) that POST labels to remote APIs; those failures mimic “checkout broken” in support chat.

If you maintain .htaccess rewrite rules for language folders (/fr/, /en/), curl each locale path with -vI and confirm redirects stay on HTTPS without loops. Multistore managers should open each back-office URL from a phone on cellular data, not Wi‑Fi split-tunnel.

Export a post-incident checklist for agencies: who owns hosting, who owns registrar, and where parameters.php lives off-repo.

When to use automation

Merchants notice SSL at payment step. Schedule live TLS checks on storefront, back office, and webhook paths payment modules document.

Use /check post-renewal. ssldays alerts at 30, 14, 7, and 1 day buy time before weekend markets when hosting support is slow.

PrestaShop marketplace modules phone home over HTTPS—expired storefront TLS can break license validation unrelated to cart UX. Monitor back-office URL and prestashop- webhook paths payment gateways document. RDAP alerts protect domains that host TXT for Google Merchant verification.

See checkout SSL expired ecommerce and WordPress SSL certificate expired for parallel CMS hosting patterns.

PrestaShop agencies frequently host dozens of small merchants on one Plesk server—one expired default SSL on the shared IP surfaces as many prestashop ssl certificate expired tickets at once. Triage should identify whether the report is isolated or fleet-wide before editing individual shop settings. Merchants running one-click upgrades during an outage can leave maintenance mode files behind; remove them after TLS heals so Google does not index splash pages.

European VAT and invoice modules that fetch government APIs over HTTPS will log silent failures while the homepage still renders from cache. Train clients to watch carrier tracking pages and payment return URLs, not only the logo banner at the top of the theme.

Prestashop ssl certificate expired closures need evidence on guest checkout, not only homepage .prestashop.com modules demo pages. Export carrier label URLs and payment module callback endpoints from module settings—each must handshake successfully. If you edited PS_SSL_ENABLED during the incident, document final values and clear Smarty cache twice to avoid ghost HTTP links in compiled templates.

Agencies should store hosting panel credentials beside PrestaShop admin because back office may be unreachable until TLS recovers at the host. Train merchants to run /check before weekend market hours when OVH or Ionos support queues lengthen.

Merchant training for PrestaShop should emphasize that SSL toggles in the back office configure URL generation and redirects, but the hosting company or server administrator must still renew the actual certificate visitors negotiate on port four forty three. Franco phone European hosting conventions mean support calls spike on Monday morning after weekend certificate expirations on small OVH instances. Keep a printed runbook in French and English if your clientele is bilingual.

Module vendors sometimes host update checks on their own domains; those are unrelated to your storefront expiry unless the module misreports errors. Focus openssl on the shop domain printed on customer invoices. After recovery, run a smoke test that places a zero euro order through the real payment gateway in test mode to confirm return URLs succeed.

Marketplace feed exporters and Google Merchant Center pulls require stable HTTPS on the same URLs you expose in product links. SEO teams may notice crawl errors in Search Console that lag actual recovery by a day; note that delay in the ticket closure summary. Association memberships and B2B portals that embed PrestaShop catalog widgets over HTTPS need the same renewed chain as the main shop before partners re enable syndication. Warehouse handheld scanners using HTTPS REST endpoints for stock will reject expired certificates even when the public catalog looks online on cellular browsers. Classroom training portals that embed PrestaShop demos for students should use dedicated hostnames monitored separately from production merchant URLs. Flash sales promoted on radio often drive traffic to bare apex hostnames; verify both apex and www after renewal before spots air. Marketplace vendors fulfilling through PrestaShop dropship modules need carrier label hosts checked alongside the storefront hostname. Pop up retail experiments on subdomains need those labels on the monitoring calendar even when the main catalog drives most revenue. Regional distributors white labeling PrestaShop should verify TLS on each vanity domain before shipping tablets to store managers. Franchise onboarding packets should list the hosting login used to renew TLS. Print the new certificate expiry date on the merchant recovery checklist. File the hosting ticket number with finance.