SSL certificate expired? What it means and how to stop it happening
When a security certificate expires, browsers show visitors a full-page warning instead of your website. Here is what that means, how to check yours, and how to make sure it never catches you out.
The padlock next to your web address comes from a security certificate (often called an SSL certificate). It proves your site is really yours and keeps what visitors type private. Certificates don't last forever: most now last about 90 days and renew automatically. If renewal fails, your site stays online, but visitors see a warning instead of your pages.
What visitors see
Instead of your website, browsers show a full-page warning such as "Your connection is not private". Most people leave immediately, and many won't come back. Online payments and contact forms stop being trusted too.
Why certificates expire without warning
- Automatic renewal failed after a change to the domain's settings.
- The hosting plan or the card it bills was cancelled or expired.
- The site moved to a new host and the certificate wasn't set up there properly.
- A certificate was installed by hand years ago and nobody remembered to renew it.
How to check when yours expires
In most browsers, click the padlock or the settings icon next to your web address, open the connection or certificate details, and look for the "valid until" date. If it's within the next two weeks and you didn't expect that, ask your host or developer now.
How to stop it happening
Use a host that renews certificates automatically, and have something check the expiry date for you. Automatic renewal normally happens weeks before expiry, so a certificate that's still unrenewed two weeks out is a sign renewal is failing, and that's the moment to act.
Don't forget the domain itself
Your domain name has its own renewal date, usually yearly. If it lapses, both your website and your email stop working. Check the renewal date with your registrar and make sure the card on file is current.
Common questions
Is SSL the same as HTTPS?
Near enough. HTTPS is the secure connection; the certificate is what makes it possible. If your address starts with https and shows a padlock, the certificate is working.
Do I have to pay for a certificate?
No. Free certificates are trusted by every major browser and are what most hosts use today.
Will an expired certificate affect Google?
Google prefers secure sites, and visitors who hit a warning leave straight away. Both hurt, so fix it as soon as you know.