HP Printer SSL Certificate Expired? Here’s How to Fix It (Mac & Windows)

If your HP printer suddenly refuses to print and your Mac or Windows PC shows an “Expired Certificate – Check the printer for errors” message, you’ve landed in the right place. This SSL certificate error is one of the most common — and most misunderstood — HP printer problems out there.

The frustrating truth: your printer’s SSL certificate may not actually be expired. Your computer just no longer trusts it. This guide explains exactly why that happens and walks you through every fix, from a simple one-click reset to a terminal command that solves it permanently.

What Is the HP Printer SSL Certificate Error?

HP printers use a self-signed SSL certificate to encrypt communication between your computer and the printer over your local network. This certificate is generated by the printer itself and tied to its network hostname — something like HPXXXXab.home or HPOfficeJetPro.local.

The “Expired Certificate” or SSL error typically appears for one of these reasons:

The printer reset itself after a power outage, firmware update, or factory reset — generating a brand new certificate your computer no longer recognizes
Your Mac or Windows system updated and lost its stored trust for the printer’s previous certificate
The printer is connecting via IPPS (IPP over SSL/TLS) and your OS is strictly enforcing certificate validation
The printer’s IP address changed, breaking the previously trusted connection

The certificate shown in your printer’s web interface might say it was issued today and expires 10 years from now — and yet macOS or Windows still throws an expired certificate error. That’s because the problem isn’t the cert’s validity period; it’s that your computer has no record of trusting it.

Method 1: Reset the Printing System (Mac) — Try This First

This is the quickest fix for most macOS users and takes under two minutes.

Open System Settings → Printers & Scanners
Right-click (or Control+click) anywhere in the printers list
Select “Reset printing system…”
Confirm when prompted — this removes all saved printers
Click Add Printer, Scanner, or Fax… and re-add your HP printer

When macOS rediscovers the printer, it re-establishes a fresh trust relationship with the current certificate.

Note: This removes all printers from your Mac. You will need to re-add each one manually.

Method 2: Trust the Certificate via the Printer’s Web Interface

Every HP printer runs a built-in web server called the HP Embedded Web Server (EWS). You can use it to view and manage the printer’s certificate.

Step 1: Find your printer’s IP address

On Mac: Open System Settings → Printers & Scanners → click your printer → Options & Supplies → the IP is listed there. Alternatively, print a Network Configuration Page from the printer’s own control panel.
On Windows: Go to Control Panel → Devices and Printers → right-click your HP printer → Printer Properties → Ports tab.
On the printer itself: Navigate to Setup → Network → Network Configuration or print a network summary page.

Step 2: Open the printer’s web interface

In your browser, go to:

https://192.168.1.x

(Replace with your actual printer IP — for example, https://192.168.1.105)

Step 3: Accept the certificate warning

Your browser will show a security warning. Click Advanced → Proceed to [IP address]. This doesn’t make the certificate globally trusted, but it confirms the printer is reachable.

Step 4: Delete the old HP cert from Keychain (Mac)

Open Keychain Access (search in Spotlight)
Search for “HP” or your printer’s hostname
Delete any expired or untrusted HP certificates
Restart your Mac and try printing

Method 3: Switch from IPPS to Plain IPP via Terminal (Mac) — Most Reliable Fix

This is the fix that works when everything else fails. By default, macOS connects to HP printers using IPPS — IPP encrypted with SSL. When the printer’s certificate changes, macOS blocks the connection entirely.

The solution is to re-add the printer using plain IPP (no SSL), which bypasses certificate validation on your local network while keeping printing fully functional.

Step 1: Check how your printer is currently connected

Open Terminal (search Spotlight for “Terminal”) and run:

lpstat -v

You’ll see output like this:

device for HP_ENVY_Inspire_7900_series: dnssd://HP%20ENVY%20Inspire%207900%20series._ipps._tcp.local./

The _ipps in the URL confirms it’s using SSL — that’s the source of the problem.

Step 2: Find your printer’s IP address via Terminal

arp -a

Look through the output for your printer. It will show a hostname containing your printer’s model name or a code matching its MAC address, alongside an IP address. Example output:

hpofficejet.home (192.168.1.105) at 48:9e:bd:a1:2b:cc on en0

Your printer’s IP in this example is 192.168.1.105. Note yours down.

If you’re unsure which entry is your printer, cross-reference with the MAC address printed on a sticker on the bottom or back of the printer.

Step 3: Remove the existing printer entry

sudo lpadmin -x HP_ENVY_Inspire_7900_series

Replace HP_ENVY_Inspire_7900_series with your actual printer name as shown in lpstat -v output. If you get “The printer or class does not exist,” that’s fine — it was already cleared. Move on to Step 4.

Step 4: Re-add the printer using plain IPP

sudo lpadmin -p My_HP_Printer -E -v ipp://192.168.1.105/ipp/print -m everywhere

Replace My_HP_Printer with whatever name you want to give it, and 192.168.1.105 with your actual printer IP from Step 2.

Step 5: Set it as your default printer

sudo lpoptions -d My_HP_Printer

Step 6: Send a test print

echo "test" | lp -d My_HP_Printer

If a page prints, you’re done. This fix persists across reboots and printer restarts — as long as the printer’s IP address doesn’t change (more on that below).

Method 4: Manually Trust the Certificate via Terminal (Mac)

If you prefer to keep using encrypted IPPS but want to resolve the trust issue properly, you can manually download and install the printer’s certificate into macOS’s system keychain.

# Step 1: Download the certificate from your printer
openssl s_client -connect 192.168.1.105:443 </dev/null 2>/dev/null | openssl x509 -outform PEM > /tmp/printer_cert.pem

# Step 2: Add it to the macOS System Keychain as a trusted root
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/printer_cert.pem

Replace 192.168.1.105 with your printer’s actual IP address.

After running these two commands, restart your Mac. macOS will now trust the printer’s self-signed certificate system-wide, and IPPS connections will work normally.

Heads up: If your printer ever resets and regenerates its certificate, you’ll need to repeat this process.

Method 5: Clear the CUPS Print Queue Cache (Mac)

Sometimes stale data in macOS’s print system (CUPS) causes persistent errors even after re-adding the printer. This clears it completely:

sudo rm -rf /var/spool/cups/tmp/*
sudo launchctl stop org.cups.cupsd
sudo launchctl start org.cups.cupsd

After running these commands, try adding your printer again from System Settings → Printers & Scanners.

Windows Fixes for HP Printer SSL Certificate Error

Method 1: Remove and Re-Add the Printer

Go to Settings → Bluetooth & devices → Printers & scanners
Select your HP printer → click Remove
Click Add a printer or scanner and let Windows rediscover it
If it doesn’t appear automatically, click The printer I want isn’t listed

Method 2: Add the Printer by IP Address Directly

This bypasses any SSL/DNS discovery issues:

Go to Control Panel → Devices and Printers → Add a printer
Click The printer I want isn’t listed
Select Add a printer using a TCP/IP address or hostname
Enter your printer’s IP address (e.g., 192.168.1.105)
Select Generic Network Card if prompted for a device type
Complete the wizard — Windows will install the appropriate HP driver

Method 3: Reinstall HP Smart App

Uninstall HP Smart via Apps & Features (Settings → Apps)
Download and reinstall the latest version from the Microsoft Store
Let HP Smart detect and reconfigure your printer from scratch

Method 4: Regenerate the Printer’s Certificate

If the root cause is a corrupted or problematic certificate on the printer itself:

Open your browser and go to http://[printer-IP] (use HTTP, not HTTPS)
Log in to the HP Embedded Web Server
Navigate to Security → Certificate Management (or Certificates)
Select Create Self-Signed Certificate and generate a new one
Remove and re-add the printer on your computer

This forces a clean certificate that your computer can establish fresh trust with.

How to Prevent This From Happening Again

The HP printer SSL certificate error will keep recurring as long as your printer is using a dynamic IP address. Every time the printer gets a new IP, you may need to redo the connection.

The permanent solution: assign your printer a static IP.

Log in to your router’s admin panel (usually 192.168.1.1 or 192.168.0.1)
Find DHCP Reservations or Address Reservation settings
Find your printer by its MAC address and assign it a fixed IP (e.g., 192.168.1.105)
Save and reboot the router

Now your printer will always have the same IP, and connections established via Method 3 or 4 above will never break due to an address change.

Quick Troubleshooting Reference

Symptom	Best Fix
Mac shows “Expired Certificate” on every print	Method 3 — Switch to plain IPP via Terminal
Error appeared after firmware update	Method 1 — Reset printing system
Error appeared after power outage	Method 1 — Reset printing system
Browser can’t open printer web page	Try `http://` instead of `https://`
Windows shows certificate error	Method 2 — Add via TCP/IP address
Error keeps coming back after every fix	Method 4 — Trust cert via Terminal, then assign static IP
Print jobs stuck in queue	Method 5 — Clear CUPS cache

Frequently Asked Questions

Is it safe to use plain IPP instead of IPPS on a home network?

Yes, for home and small office networks. IPPS encrypts traffic between your computer and printer, but on a private local network this provides minimal practical security benefit. The certificate error causes more disruption than the risk you’re mitigating by using IPPS locally. Enterprise environments may have different requirements.

Will this fix survive a printer restart or firmware update?

If you used Method 3 (plain IPP), yes — the connection doesn’t rely on the certificate at all. The only thing that can break it is a change to the printer’s IP address, which is why assigning a static IP (see above) is recommended.

Does this apply to other HP printer models?

Yes. Any HP printer running HP’s IPG firmware — which includes most ENVY, OfficeJet Pro, DeskJet, and LaserJet models manufactured after 2015 — can exhibit this SSL certificate behavior. The fixes above apply across all of these models.

Why does the certificate show as valid but macOS still blocks printing?

The certificate’s dates are not the issue. The problem is that macOS requires a trust record for any certificate it uses. When the printer regenerates its certificate (after a reset, for example), macOS has no record of the new one, and it blocks the connection regardless of the cert’s validity dates.

My printer isn’t HP — does this apply to me?

Similar SSL certificate trust issues can affect Brother, Canon, and Epson network printers as well. The Mac terminal methods (Method 3 and Method 4) work for any brand — just substitute your printer’s IP and name accordingly.

If this guide helped you fix your HP printer SSL certificate error, consider bookmarking it — this issue tends to reappear after firmware updates.