SSL Certificate Renewed but Still Showing the Old Certificate? Why and How to Fix It
You renewed an SSL certificate and deployed the new file, but the browser still shows the old certificate, the old expiry date, or the old issuer. Usually the renewal itself is fine; something between the client and the new certificate is still serving the old one. This guide explains the common reasons and how to confirm with the Serial Number and SHA-256 fingerprint, including how SSL Certificate Decoder helps you compare the certificate bytes clients actually receive.
Why the old certificate is still shown after renewal
A renewed certificate only takes effect where it is actually loaded. If clients still see the old certificate, the request is almost certainly reaching a server or cache that has not picked up the new file. Check the following layers in order.
CDN or edge cache
If traffic goes through a CDN, the CDN may cache the TLS certificate at the edge nodes. Renewing the origin certificate does not automatically push the new certificate to every edge location until the CDN reloads or redeploys the certificate bundle. A purge of cached HTTPS resources usually does not help here; the certificate on the CDN edge must be redeployed or waited out.
Load balancer or multiple web servers
When several web servers sit behind a load balancer, the new certificate may have been copied to only one of them. Subsequent requests are load-balanced to other nodes that still hold the old file, so the browser alternates between old and new certificates from visit to visit. Confirm that every backend node was updated and that each was reloaded.
IPv4 and IPv6 use different certificates
A domain can resolve to both an IPv4 address (A record) and an IPv6 address (AAAA record). If you installed the new certificate only on the IPv4 listener, clients that prefer IPv6 still receive the old certificate. Test both families explicitly rather than relying on a single hostname lookup.
Root domain and www serve different certificates
The apex domain and the www subdomain may point to different servers, proxies, or CDN configurations. Renewing the certificate for example.com does not automatically cover www.example.com if that host uses its own listener or edge configuration. Compare both names separately.
Missing intermediate certificate chain
Sometimes the leaf certificate is new, but the server still sends the old or incomplete intermediate bundle. Browsers may then fall back to a cached or previously built chain, which can make it look like the old certificate is still active. The decoded chain shows whether the intermediate certificates match the new leaf.
Browser and local cache
Browsers and operating systems cache TLS sessions and certificate data. A service restart, a new incognito window, or clearing the host cache is sometimes enough to reveal whether the server side has actually been fixed. If incognito shows the new certificate but your normal window shows the old one, the issue is local caching rather than the server.
Confirm whether the new certificate is really being served
Do not judge from the domain name, issuer, or expiry date alone. The Serial Number and the SHA-256 fingerprint identify the exact certificate bytes, so they are the fastest way to tell whether clients are receiving the renewed certificate.
Retrieve the public certificate from each path clients actually use, for example with openssl s_client:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -serial -fingerprint -sha256 -datesRepeat this for the root domain, the www host, the IPv4 address, the IPv6 address, and the CDN endpoint. Save each returned PEM block, or copy the printed Serial Number and SHA-256 fingerprint. Then open SSL Certificate Decoder, paste each PEM block, and compare the displayed Serial Number and SHA-256 Fingerprint character for character.
| Observation | What it means |
|---|---|
| All paths show the new Serial Number and fingerprint | The renewal is fully deployed; any remaining old-certificate warning is local browser or OS caching. |
| One path still shows the old Serial Number | That path has not picked up the new certificate. Fix that specific edge, node, DNS family, or host. |
| Fingerprint changes between requests | Load balancing between updated and not-yet-updated backends. Roll out the certificate to every backend. |
Step-by-step fix
- Collect the public certificate from every entry path: root domain, www, IPv4, IPv6, and the CDN edge if one exists.
- Decode each certificate with SSL Certificate Decoder and record its Serial Number and SHA-256 fingerprint.
- Identify the path that still serves the old certificate. That is the layer to fix, not the origin file that is already correct.
- Deploy the new certificate bundle to that layer: redeploy at the CDN, copy the file to every load-balanced backend node, install it on the IPv6 listener, and fix the www host configuration.
- Reload the web server or edge service so it re-reads the file. Do not assume a file copy alone takes effect.
- Re-run the same Serial Number and SHA-256 comparison until every entry path reports the new certificate.
- Verify in a fresh incognito window and, if needed, clear the local host cache or restart the browser.
Common questions
Why is my certificate still old after renewal?
Usually because a CDN, a second backend server, an IPv6 listener, or the www host is still serving the previous file. Renewing the origin file only updates the one place you changed.
Serial Number vs fingerprint: which tells me the replacement worked?
The Serial Number changes every time a new certificate is issued, so it shows whether the issued certificate changed. The SHA-256 fingerprint identifies the exact bytes you are comparing. Use both together: matching serial plus matching fingerprint confirms the same renewed certificate is being served.
Decode and compare before you close the ticket
Keep the new certificate's Serial Number and SHA-256 fingerprint next to the list of paths you checked. When each path returns the same values, the renewed certificate is actually in front of clients.
Open SSL Certificate Decoder
