SSL Certificate Expired
SSL, Security & Connection
A full-page security warning now stands between you and every customer.
Visitors get a full-page interstitial — “Your connection is not private”, NET::ERR_CERT_DATE_INVALID, or “This site's security certificate has expired” — and have to click through a warning to reach you. Most do not.
What it actually means
Certificates are deliberately short-lived. They are a signed statement that you controlled this domain on a particular date, and that statement is set to expire so a stolen one cannot be used forever. Most now last ninety days.
When one lapses, the browser cannot verify who it is talking to, so it stops the visitor with the loudest warning it has. The site itself is fine. The lock is simply out of date, and every browser in the world is telling your customers not to trust you.
What usually causes it
Most likely first.
- 1
Auto-renewal silently stopped
The renewal process needs to prove domain control, usually over HTTP. A redirect rule, a firewall, or a moved webroot breaks that check, and renewals fail quietly for weeks before expiry.
- 2
The certificate renewed but was never installed
Common when a certificate is issued by one system and served by another — a CDN, a load balancer, or a proxy still holding the old file.
- 3
DNS moved and validation broke
If the domain now points somewhere else, the renewal check validates against a server that is no longer yours.
- 4
A manual certificate nobody owned
Someone installed it by hand a year ago, the reminder went to an inbox that no longer exists, and the calendar ran out.
- 5
The domain itself expired
If registration lapsed, certificate renewal fails alongside everything else. Check the domain before you debug the certificate.
How to fix it
Work through these in order. Take a backup before you change anything.
Step 1 — Confirm what actually expired
Click the padlock or use an SSL checker to read the certificate's validity dates and which hostnames it covers. A certificate valid for example.com but not www.example.com produces the same warning.
Step 2 — Renew it now
On managed hosting this is usually one button. With Let's Encrypt, run the renewal manually and read the output — the error it prints is the reason auto-renewal has been failing.
Step 3 — Install it everywhere it is served
If you run a CDN, load balancer, or reverse proxy, the certificate has to be current there too. Renewing at the origin alone leaves the warning in place for visitors.
Step 4 — Fix the validation path
Make sure the renewal challenge can complete: no redirect swallowing the well-known path, no firewall rule blocking the validating service.
Step 5 — Set up monitoring
Add an expiry check that alerts you two weeks out. This failure is entirely preventable and entirely invisible until the morning it is not.
When to stop and call someone
Call someone if renewal keeps failing after you fix the obvious causes, if the certificate is current at the origin but visitors still see a warning, or if the site takes payments — a security interstitial in front of a checkout costs money every hour it stands.
Frequently asked
Browsers stop trusting the connection and show a full-page security warning before the site loads. The website itself keeps working, but most visitors will not click past the warning, so in practical terms the site is offline until the certificate is renewed.
Usually minutes. On managed hosting it is often a single renew button, and a Let's Encrypt certificate reissues in under a minute. The delay is rarely the renewal itself — it is finding why automatic renewal stopped working.
Most often because the domain-control check could no longer complete. A redirect rule, firewall, moved webroot, or DNS change blocks the validation request, so renewal fails silently — often for weeks before anyone notices at expiry.
Yes, if it persists. Search engines treat HTTPS as a ranking signal and crawlers hitting certificate errors may stop fetching pages. The bigger immediate cost is behavioral: visitors bounce at the warning, which damages engagement signals too.
Automate renewal and monitor it separately. Automation fails silently, so the monitoring is the part that saves you — an alert two weeks before expiry turns an emergency into a routine task.
If you’d rather not
We do this work every week. These are the services that cover it.
- Fixing Broken WebsitesSite down, hacked, or falling apart? We diagnose it fast, fix what's broken, and tell you straight how to keep it from happening again.
- Malware Removal & SecurityA hacked site costs you customers and Google's trust at the same time. We remove the malware, close the hole that let it in, and harden what is left.
- SEO & Google Visibility RecoveryWhen traffic falls off a cliff, guessing is expensive. We find why Google stopped showing your pages — and fix the cause, not the symptom.
See exactly what’s holding your website back.
Get a free audit of your site — speed, SEO, mobile, and security — with the fixes that matter most, delivered as a PDF to your inbox.