"Your connection is not private." That is what visitors see when your site's SSL certificate has expired. Most of them will leave, and search engines and customers lose trust in the site. It is also one of the most avoidable outages there is.

What an SSL certificate does

The certificate proves that your visitor is really talking to your server, and it enables the encryption behind https://. Each certificate is valid for a limited time. Certificates from Let's Encrypt, which many hosts use, are valid for 90 days, and others for a year or less. Once the date passes, browsers refuse to trust it.

Why certificates expire without anyone noticing

  • Automatic renewal stopped working. A changed server setting, a moved site, a full disk, a firewall rule or a changed DNS record can break the renewal job silently.
  • A manual certificate was forgotten. A certificate you bought once and installed by hand needs a reminder that someone actually reads.
  • A forgotten subdomain. The main site renews, but shop. or api. runs on a different certificate that nobody tracks.
  • The person who set it up left.

How to fix an expired certificate

  1. Check what you have. Our free SSL certificate checker shows the issuer, the expiry date, the names the certificate covers and whether the chain is complete.
  2. Renew it. On managed hosting, look for the SSL or "Let's Encrypt" section of your control panel and press renew or reissue. On your own server, run your client's renewal (for example certbot renew) and read its output for errors.
  3. Reload the web server so it starts using the new certificate (nginx -s reload or restarting Apache).
  4. Check again from outside, from another network, and also check every subdomain you use.
  5. If renewal fails, look at the error. The usual causes are DNS records that point to a different server, a blocked port 80 or 443, and rate limits after repeated failures.

How to make sure it never happens again

  • Automate renewal and test that it works, instead of trusting that it does.
  • Monitor the expiry date from the outside. A monitor that reads the certificate your visitors actually get catches broken renewals, forgotten subdomains and wrong certificates. ServerMonitor warns you weeks before expiry and again when the certificate is renewed.
  • Write down where each certificate lives and who is responsible for it.
  • Keep your contact email current with the certificate authority, so their warnings reach someone.

An expired certificate is a small problem that looks like a big one. The fix usually takes minutes. The damage happens in the hours before anyone notices, so the goal is to find out first.