SSL Certificate Expired: What Visitors See and the Fix

A customer messages you: “Your website says it’s not safe.” You open it on your phone and, instead of your homepage, there is a full-screen warning saying the connection is not private. Nothing on the site changed. You did not touch anything. Yet the site looks, to anyone visiting, like it has been taken over.

Most of the time this is not a hack. It is an SSL certificate that has expired, or failed to renew. It is usually fixable once you find where the renewal broke, and it helps to know what visitors are actually seeing and where the renewal usually breaks.

What visitors see when a certificate expires

Browsers do not quietly show a broken padlock for an expired certificate. They stop the page from loading and show a warning instead. The wording varies:

• Chrome and Edge show “Your connection is not private”, often with the code NET::ERR_CERT_DATE_INVALID in small text.
• Firefox shows “Warning: Potential Security Risk Ahead”.
• Safari shows “This Connection Is Not Private”.

Some browsers offer an “Advanced” link that lets a visitor continue anyway, but most people will not click it, and they should not have to. If your site has HSTS switched on, which tells browsers to only ever use HTTPS for your domain, the browser may not offer a way through at all.

The damage goes beyond the homepage. Contact forms, checkout pages and login pages all sit behind the same warning. Payment gateways and other services that send data back to your site, such as order confirmations, may also start failing, because their servers refuse to talk to a site with an invalid certificate. So a store can look fine to you in a browser you have already clicked through, while orders quietly stop updating.

First, confirm it really is the certificate

The same warning screen can appear for a few different reasons, so check before changing anything.

1. Look at the error code. A date-related code points to expiry. A code mentioning the name or “common name” points to a certificate that does not cover the address being visited, for example one issued for example.com but not www.example.com.
2. Click the warning icon in the address bar and view the certificate. It shows the “valid from” and “valid to” dates and the domains covered.
3. Run the domain through our SSL checker. It shows the expiry date and issuer from outside your own device.
4. Check from a second device or network. If only one person sees the warning, their computer’s clock may be wrong. A device with the wrong date will reject perfectly valid certificates.

If the dates confirm the certificate has expired, move on to finding out why it did not renew.

Why certificates fail to renew

Free certificates, such as those from Let’s Encrypt that most hosts provide, are short-lived and designed to renew automatically. When one expires, the automation has usually been broken by something else. Paid certificates bought separately often expire for a simpler reason: nobody renewed the order.

The common causes:

• The domain’s DNS was changed. To renew, the certificate authority needs to reach your server through your domain. If DNS was moved to Cloudflare or another provider, or the domain now points to a different server, the host’s renewal check may fail without anyone noticing.
• A redirect or security rule blocks the check. Renewal often works by placing a small file in a folder called /.well-known/acme-challenge/. An aggressive redirect, a firewall rule or a security plugin that blocks unknown paths can stop the certificate authority from reading it.
• The site was moved to a new host and the old certificate came with it as a manual install, without the new host’s automatic renewal being switched on.
• A paid certificate was bought through a reseller and the renewal reminder went to an old email address, or to a developer who no longer works with you.
• Part of the site is not covered. The main domain renewed, but www, a subdomain or a separate shop address was never included.
• The certificate sits in two places. With a CDN or cloud firewall in front of your site, there can be one certificate at the CDN and another on your server. Either can expire.

Reminder emails are not something to rely on. They go to whatever address was used when the certificate was first set up, which is often not one anyone checks.

How to fix an expired certificate

The fix depends on where the certificate comes from. If you have never installed one before, our guide on how to add an SSL certificate to your website walks through the setup itself. For a renewal, the steps are usually these.

If your host provides a free certificate

1. Log in to the hosting control panel and open the SSL or Let’s Encrypt section.
2. Look for an error message next to the domain. It usually says why the last renewal failed, for example that the domain did not resolve to this server.
3. Fix that cause first, such as correcting the DNS record or removing the rule blocking /.well-known/.
4. Reissue or renew the certificate, making sure both the main domain and www are ticked.
5. Check that automatic renewal is switched on.

If you bought a certificate separately

1. Find who sold it to you: a domain registrar, a hosting company or a certificate reseller.
2. Renew it there, then complete the validation step they ask for, usually an email or a DNS record.
3. Install the new certificate files on the server, or ask your host to do it.
4. Consider whether you still need a paid certificate at all. For most small business sites a free, automatically renewing one gives the same encryption.

If you use a CDN or cloud firewall

Check the certificate at both ends. The CDN’s dashboard shows the certificate visitors see. Your host shows the one on your server, which the CDN connects to. If the CDN is set to a strict mode that checks your server’s certificate, an expired origin certificate can break the site even when the CDN’s own certificate is fine.

After the fix: check properly

• Open the site in a private browser window and on a phone using mobile data, not your office connection.
• Check the main domain, the www version and any subdomains you use.
• Run the SSL checker again and note the new expiry date.
• Place a test order or submit the contact form, and confirm payment notifications and emails still arrive.
• If you have a WooCommerce store, look for orders stuck as pending during the outage and confirm them against your payment gateway.

Browsers sometimes cache the warning for a short while. If the checker shows a valid certificate but one device still complains, close the browser fully and try again.

Stopping it happening again

Expiry is predictable, which makes it one of the easier outages to prevent.

• Put the expiry date in a shared calendar, with a reminder well before it, even if renewal is automatic.
• Make sure renewal emails go to an address someone in the business reads.
• Use an uptime monitoring service that also checks certificate expiry. Many do, and they warn you before visitors notice.
• Whenever DNS changes, the domain moves or a CDN is added, check the next renewal actually succeeds.
• Keep a short note of where the certificate comes from and who has the login to renew it.

If you would rather not chase this yourself

Most expired certificates come down to one small setting in DNS, hosting or a firewall. Finding which one is usually the slow part. If your site is showing the warning now and you are not sure where to start, our hosting and domain support can find the cause, renew the certificate and check that renewal will work next time.

Next in this series: The 3-2-1 Backup Rule for Business Websites