SSL certificate expired: what to do now and how to stop it happening again

One day you open your website and, instead of the home page, the browser shows a full-screen warning: “Your connection is not private”. Many visitors close the page right there. Often the cause is simple: the SSL certificate has expired.

The certificate is what lets your site run over HTTPS (the padlock in the address bar): it encrypts data between the visitor and the site and confirms the site is who it claims to be. It has an expiry date, and once it passes, browsers stop trusting it.

First: who manages your certificate?

Where you bought your domain does not matter here: the domain and the certificate are two separate things. Buying a domain from a registrar such as GoDaddy does not, by itself, give you a certificate. What matters is who issues and renews the certificate, and situations vary a lot.

Very low risk: the certificate is managed by the platform. If your site goes through Cloudflare (with the proxy on) or is published on platforms such as Cloudflare Pages, Vercel, Netlify, Shopify, Wix or Squarespace, the certificate is part of the service: it is issued and renewed automatically, without you doing anything. That is why many people have never seen a certificate expire.

Real risk: the certificate depends on you or your hosting.

• WordPress on traditional hosting: the certificate is usually automatic, but renewal can stop silently after a change of DNS, host or plan.
• A self-managed server or VPS (with Certbot or similar tools): if the scheduled renewal task breaks, nobody notices until the site shows the warning.
• A purchased certificate renewed by hand once a year: it only takes someone forgetting, perhaps because the person who set it up has left.
• A site behind Cloudflare with an expired certificate on the origin server: visitors see Cloudflare’s certificate, which is valid, but the site stops working anyway.

If your site is in the first group, you can relax. If it is in the second, the rest of this article is for you.

1. Confirm the problem is expiry

The browser warning can have different causes. To find out which:

• look for the error code in the warning: in Chrome, NET::ERR_CERT_DATE_INVALID means the certificate has expired (or the computer’s clock is wrong: check that too);
• or use a free online check such as SSL Labs: enter your domain and it shows the expiry date and any other problems.

If the error talks about a name mismatch instead, the certificate does not cover the address you visited (for example it covers www.yoursite.com but not yoursite.com). That is a different problem, solved by issuing a certificate that includes both.

2. Renew it, and find out why it stopped

How you renew depends on who manages the certificate: the hosting panel, the provider you bought it from, or Cloudflare. In all cases, renewing is only half the job: most modern certificates renew on their own, so if yours expired, something blocked the renewal. A change of hosting or DNS, a plan change, a DNS setting that only allows certain certificate authorities, or a certificate bought by hand and simply forgotten.

If the cause isn’t found and fixed, the same problem comes back at the next expiry. This is the part that’s worth handing to whoever manages your site, or to us.

One thing not to do: tell visitors to “proceed anyway”. It trains them to ignore a security warning, which is exactly the habit attackers rely on.

3. Make sure it does not happen again

Certificates are getting shorter. Since 15 March 2026 a public certificate can last at most 200 days; the limit drops to 100 days in March 2027 and 47 days in 2029. Renewing by hand will become impractical: automatic renewal is no longer optional, it is the norm.

To sleep soundly:

• make sure renewal is automatic and actually works (the expiry date should move forward on its own, weeks before expiry);
• set up monitoring that emails you if the certificate is about to expire: many website monitoring services, including free ones, include this check;
• if you still have a manually renewed certificate, set a reminder at least 30 days before expiry, and consider switching to automatic renewal.

A note on HSTS

If your site uses HSTS (a setting that forces browsers to always use HTTPS), visitors facing an expired certificate cannot even choose to continue: the site is simply unreachable. It is excellent protection, but it makes it even more important that renewal never stops.

In short

Confirm it is expiry, renew, find out why automatic renewal stopped, and set up an alert before the next expiry. With certificates getting shorter every year, an automatic check is worth more than any calendar reminder.