SSL certificate expired

A browser warns when the certificate is expired, the name does not match, or the chain is incomplete. Expired means the notAfter date is in the past.

A new certificate comes from the same issuer as before, for example Let's Encrypt or the host's panel. It has to be installed on the server that terminates TLS, together with the intermediate certificates.

A site proxied by Cloudflare has a certificate at the edge and one on the origin. Either one can expire. The warning shows the certificate the browser saw.

After installing it, open the site on the name visitors use. A check against localhost says nothing about the public name.