My security certificate has expired — what now?
Worth sorting promptly
An expired certificate is the one website problem your customers will definitely notice: instead of your site, they get a full-page red warning telling them it isn't safe. Most leave. The good news is that renewal is usually free and usually automatic — a lapse normally means the automation broke, not that you owe anyone money.
What a certificate actually does
Your security certificate does two jobs: it scrambles the connection between your visitor and your site, and it proves your site is really yours rather than an impostor. It's what puts the padlock in the address bar.
Certificates are deliberately short-lived. The most common kind, issued free by Let's Encrypt, lasts 90 days and is designed to renew itself automatically roughly a third of the way through. Paid certificates typically run a year.
That short life is a security feature, not an inconvenience — but it does mean the renewal has to work every single time, unattended, forever.
Why they lapse
Almost never because someone forgot to pay. In practice it's usually one of a handful of things: the site moved host and the renewal job didn't move with it; a firewall or redirect started blocking the automated renewal check; the domain's DNS changed; or a developer set the certificate up by hand once and nothing has renewed it since.
That last one is worth knowing about, because it's invisible until the day it isn't. A hand-installed certificate looks identical to an automatic one right up to the moment it expires.
What visitors see
Not a subtle warning. A full-page interstitial — “Your connection is not private” in Chrome, “Warning: Potential Security Risk Ahead” in Firefox — with the option to continue buried behind an “Advanced” link.
Most people will not click through it, and a fair number will assume your business has been hacked or has gone under. Search engines will also start dropping the site from results if it stays broken.
This is the one item on Gus's list that's genuinely worth interrupting your day for.
How to check this yourself
- Visit your site and click the padlock (or the warning triangle) to the left of the address in your browser.
- Choose “Connection is secure”, then “Certificate is valid” — the wording varies slightly by browser.
- Look for the “Expires on” or “Valid until” date. If it's in the past, that's your answer. If it's within the next 30 days, check that renewal is automatic.
- If the date is roughly 90 days out and moves on its own each month, you almost certainly have working automatic renewal and nothing to do.
What to ask your web person
Copy this. It's phrased so you don't have to know the jargon to ask for the right thing.
Our TLS certificate expired (or is about to). Could you renew it, and then confirm whether renewal is automated? If it was installed by hand, could we move to an automatically-renewing certificate so this can't recur — and is there any monitoring on the expiry date?
Want to know if this applies to your site?
Gus checks this and everything else in the free check-up, then explains what he found in plain English. It's free, there's no account, and it takes about a minute.