SSL certificate renewal and expiry
Free certificates renew themselves and myPandos watches them; paid certificates renew on your billing cycle. Here's what happens, and what to do when a renewal fails.
Every SSL certificate has an expiry date. What you have to do about it depends on which kind you have.
Free Let's Encrypt certificates (included with hosting)
These are short-lived by design and are renewed automatically:
- Plesk renews them itself, starting roughly 30 days before expiry and retrying nightly.
- myPandos runs its own daily check on top of that. If a certificate is still not renewed 14 days before it expires, that means Plesk's automation has already failed many attempts — so we re-issue the certificate for you and alert our team if it still will not issue.
- The watchdog will never replace a paid or managed certificate with a free one. If it finds a certificate from a commercial authority, it leaves it alone and raises an alert instead.
In normal operation you do nothing. If you ever need to force a renewal yourself, open the domain in Plesk, go to SSL/TLS Certificates and use Reissue certificate.
Certificates you bought from myPandos
- They renew on a billing cycle: you receive a renewal invoice before the certificate's term ends, and paying it keeps the certificate going.
- Auto-renew is on by default for SSL services. You can see the service and its renewal date under Products → SSL Certificates at dash.mypandos.io.
- When a renewal completes we email you an “SSL Certificate Renewed” confirmation for that domain.
Renewing the billing period is not the same as re-installing the certificate on the server. If the certificate is not on the server yet, install it in Plesk after it is issued.
Why an automatic renewal fails
Almost every failed free-certificate renewal comes down to the certificate authority not being able to reach your site to prove you still control the domain. The usual causes:
- The domain no longer points at your myPandos hosting. Check the DNS records for the domain and the www subdomain.
- The domain is proxied through a third party (for example a CDN in proxy mode), so the validation request never arrives at the server.
- The site is offline or returning errors while the check runs.
- A redirect rule intercepts the validation path before it reaches the server.
Certificate authorities also rate-limit repeated failures, so hammering the reissue button makes things slower, not faster. Fix the underlying cause first, then reissue once.
What happens if a certificate expires
Visitors get a full-page browser warning and most will leave rather than click through it. Email clients connecting over TLS may also refuse to connect. Nothing is deleted — installing a fresh certificate clears the warning immediately.
Still stuck?
Open a ticket from the Support section of your dashboard with the domain name and the exact error Plesk showed. We can see the certificate's real state on the server and tell you what is blocking it.