Problem: expired certificate
Your visitors are seeing a certificate warning
"Your connection is not private." The site is fine; the certificate on it ran out, and every browser is now telling your visitors to leave. It was renewed by hand last year, or a renewal task quietly stopped working after some other change. Here is how to replace it today, and how ServerMaid makes sure it is the last time.
Free certificates* are part of the Websites and SSL module, £79 £39.50 per server for twelve months. 30-day money-back promise.
Fix it right now
- Get a new certificate. If you bought the old one, your certificate provider can reissue or renew it and give you a .pfx file. If you used a free ACME client, run its renew command by hand and read the error it prints; that error is the reason the schedule stopped.
- Import it on the server. Double-click the .pfx on the server, or use the Server Certificates page in IIS Manager, and import into the Personal store of the Local Machine.
- Point the binding at it. In IIS Manager, open the site, Bindings, edit the https binding and pick the new certificate. Do this for every hostname that has its own binding. No restart is needed.
- Check from outside. Open the site in a private browser window and click the padlock: the expiry date should be the new one. If it is still the old one, a binding is still pointing at the old certificate.
- Remove the old certificate from the store so nothing can bind to it by mistake next time.
Why renewals silently stop on Windows Server
- The HTTPS redirect swallowed the validation request. Let's Encrypt checks a path under /.well-known/ over plain HTTP. A redirect rule added later sends that request to HTTPS, or to a login page, and validation fails every night without anyone noticing.
- The binding was never updated. The client renewed the certificate into the store, but the site's binding still pointed at the old thumbprint, so the site expired with a perfectly good certificate sitting next to it.
- The scheduled task died. A password change on the account that runs it, a Windows update, or a moved folder, and the task has been failing for months.
- DNS moved. The domain was pointed at a new address, or www stopped resolving, and validation for that hostname fails.
- Nobody was told. Expiry e-mails went to whoever set the site up two jobs ago.
What ServerMaid does
Renewed on a schedule, tested on every deployment
Validation path protected
The HTTP to HTTPS redirect is written as the first URL Rewrite rule with the validation path excluded, so renewals keep working after every later change.
Binding updated in place
The renewal task replaces the certificate and re-points every binding for every hostname. A binding pointing at the wrong certificate is corrected by Repair.
Renewal tested
Every deployment checks that the task exists and fetches each hostname's validation path with a probe file, so a renewal that would fail is caught while you are looking.
Expiry on the health score
A certificate close to expiry deducts points with the site named and a Renew now action next to it. DNS that no longer points at the server is reported with the exact addresses.
Free, trusted certificates
Every website gets a Let's Encrypt certificate, trusted by every browser, ordered when the site is created. No yearly bill. How the certificate is issued.
Your own certificate too
Already have one? Adopt it from the store by thumbprint or import a .pfx. ServerMaid checks the private key and the names before binding it.
Questions about expired certificates on IIS
Does an expired certificate take the site down?
No. The server keeps serving, but every browser shows a full-page warning first, and most visitors leave. Search engines also notice a site that is not reachable over a valid HTTPS connection.
Do I need to restart IIS after changing a binding?
No. Editing the binding in IIS Manager takes effect immediately. If a browser still shows the old certificate, it is usually a cached page or a second binding for the same hostname.
Will ServerMaid renew certificates I bought elsewhere?
It binds and watches them, and reports when they are close to expiry, but it can only renew certificates it obtained from Let's Encrypt. Most sites are better off switching to a free certificate* when the paid one runs out.
How early does the renewal run?
The scheduled task runs every day and replaces the certificate well before it expires, so a few failed nights in a row still leave time to fix the cause.
Does renewal depend on my licence staying active?
No. The renewal task keeps running whatever the licence state. ServerMaid never switches off anything your visitors depend on.
Make this the last certificate you install by hand
Add each website from one form with a free certificate* that renews itself, a binding that is kept correct, and a health score that warns you before anything expires.
* Free SSL certificates need the Websites and SSL module (included in Agency and Enterprise licences) on a licence within its twelve-month period. Certificates come from Let's Encrypt; new websites get one while the licence is in date, and certificates already issued keep renewing.