Expired SSL certificates: what customers see and what to do

Picture a customer who clicks a link from your invoice and lands on a red warning page. They don't call to ask what happened. They just leave.

Nothing broke on your side except one date. The certificate expired, and the warning appeared for everyone who visited.

What is an SSL certificate, in plain English?

An SSL certificate is a small digital file that proves your website belongs to your domain name. A trusted company, called a certificate authority, issues it after checking that you control the domain.

The certificate does two jobs. It lets the browser confirm that it is talking to your site, and it encrypts what visitors send, such as form entries and log-in details. Modern sites use the newer TLS protocol, but everyone still says SSL, and this article does too.

A certificate is not the same as your domain. The domain is the name, such as yourcompany.com. The certificate is the proof, with its own end date, that the site behind that name is yours. You can renew your domain and still have an expired certificate, because the two expire on their own schedules.

What does "Your connection is not private" mean?

It means the browser can't trust the connection to your site. The most common cause is an expired certificate.

The warning usually replaces the page itself, so the visitor can't see your prices, your contact details or your forms. Google's help page for this message says it means there is a problem with the site, the network or your device. An expired certificate is a problem with the site. Your customers can't tell which one it is, and they shouldn't have to. For them, the warning looks like the site is unsafe, so they may not send the form, pay the invoice or log in.

Why will certificates expire more often?

The CA/Browser Forum sets the rules that browsers and certificate authorities follow, and the longest allowed life of a certificate is getting shorter. Until March 15, 2026, a public certificate could last up to 398 days. The schedule runs down to 47 days by March 15, 2029.

In practice, a certificate that lasts 47 days needs renewal about every seven weeks. A yearly reminder won't keep up. Every renewal is another step that can go wrong, such as a manual install that nobody repeats or a payment method that has expired.

The point of the shorter limits is security: the checks behind each certificate stay more recent. For a site owner, the effect is simpler. The renewal work comes more often, so it has to run by itself or be written down as a routine.

How do I know when my certificate expires?

Check the expiry date in your browser, or ask your host. Ward checks the certificate on your site from outside and warns you before it expires. For most certificates, the warning appears when 14 days or less are left, and it turns high at 7 days or less. For very short-lived certificates, the margin is smaller.

Ward also looks at the certificates of related names it finds, such as mail or a customer portal.

You can also check by hand. Most browsers let you click the padlock next to the address and open the certificate details, which show the end date and who issued the certificate. It takes a minute, and it is worth doing once after every change of hosting.

Who renews the certificate?

Your hosting provider or website platform can renew it for you, as long as automatic renewal is on. If you installed a certificate by hand, you or your provider has to renew and install it.

1. Find out who issued it. Your hosting control panel or website platform usually shows the certificate and its expiry date.
2. Check that automatic renewal is on. Look for an SSL or certificate section in the hosting settings, and confirm that renewal is automatic.
3. Write down the manual ones. If a certificate is installed by hand, put its expiry date in the shared calendar, with the name of the person who renews it.
4. Check every name that uses a certificate. Your website is not the only place one lives. Mail, webmail and customer portals often have their own.
5. Test after each renewal. Open the site in a private browser window, check the padlock, and submit a form.

If you can't find these settings, ask your provider to show you where they are. Keep the answer with the calendar entry.

What should I do if the certificate has already expired?

Renew it now, install it, and test. The warning goes away once browsers receive a valid certificate for your names.

1. Renew or reissue the certificate through your provider or the hosting panel.
2. Install it and check the names it covers. It has to cover your domain and the other names your site uses, such as www.
3. Test from a phone and a computer. Use a private browser window so older copies don't hide the fix.
4. Check mail and other services that use the same name. They can break at the same time as the website.
5. Tell customers in another channel if the site was unreachable for a while. Say what happened in one sentence and what you have changed.

Write down what happened and when, including when the warning started. Your provider may ask for it, and it helps you find the cause next time.

If your domain has also lapsed, fix that first. No certificate can be issued for a domain you don't control. See what happens if your domain expires.

What about certificates my vendors manage?

Booking pages, payment pages and customer portals are often run by a vendor, on a name that points to them. The vendor should renew those certificates, but the customer doesn't see the vendor. When a customer sees the warning on a page at your name, they blame you.

Ask each vendor for the expiry date of the certificate in writing, and put that date in your calendar. Ask who to call if it lapses, and keep that number with the contract.

Does automatic renewal solve everything?

It takes most of the work away. What it can't do is tell you when it fails, so the rest is noticing. Automatic renewal can still stop working when a card is declined, when the account's contact details or payment method change, or when a certificate was installed by hand and the automation never sees it.

That is why you want a warning before the expiry date, not after it. A certificate is easy to forget because it works quietly until the day it doesn't. Make renewal automatic, check the date for anything you can't automate, and keep the list of names current.

If your site runs WordPress, outdated plugins are another common way to break it. Read outdated WordPress plugins for how to keep them current.