One morning your website greets visitors with a full-page warning: "Your connection is not private". Almost always the cause is an expired SSL certificate. It is one of the most common and most avoidable website outages, and it can usually be fixed in minutes.
This guide works for any website, whether it runs on WordPress, Shopify, Wix, Joomla, Magento or custom code. The details of renewing differ by host, but the steps are the same.
What an SSL certificate does
An SSL/TLS certificate proves your site is really yours and encrypts the connection between your visitors and your server. That is the padlock and the https:// in the address bar. Every certificate has an expiry date, and once it passes, browsers stop trusting it.
What happens when it expires
- Browsers show a red warning page, and most visitors leave instead of clicking through.
- Checkout, login and contact forms can stop working.
- Search engines may drop pages, and rankings can suffer if the problem lasts.
- Apps, APIs and payment integrations that call your site may fail without any visible error.
Step 1: confirm the certificate has really expired
Do not assume. The same warning can appear when the certificate is valid but misconfigured. Run the SSL certificate checker on your domain. It shows the issuer, the dates it is valid between and the number of days left. Also check that the domain you typed, including the www version, is listed on the certificate.
Make sure your device clock is correct too. A wrong date on your own computer produces the same warning on every site.
Step 2: renew or reissue the certificate
- Hosting with free automatic SSL: open the SSL section of your control panel and run the renewal, or reissue it. Many hosts use Let's Encrypt and renew by themselves, so a failure usually means the automatic job broke.
- Website builders and shop platforms: the platform manages the certificate. Check that your domain is connected correctly and contact support if the certificate still shows as expired.
- A purchased certificate: generate a new certificate signing request, complete the validation with your provider, then install the new certificate and its intermediate chain on the server.
- Behind a CDN or proxy: renew at the CDN as well as on your origin server, as each one can have its own certificate.
Step 3: check the installation
After renewing, reload your site in a private window and run the checker again. Look for the new expiry date, and confirm that the full chain is installed. Then check that your security headers, redirects from http:// to https:// and any mixed-content warnings (images or scripts still loading over http://) are fine.
Why certificates expire unnoticed
- Automatic renewal failed after a server move, a DNS change or a control panel update.
- The renewal email went to a former employee or a forgotten mailbox.
- A site, subdomain or staging copy was set up by someone who has since left.
- The domain itself lapsed. See our check for domain expiry.
How to stop it happening again
- Set a calendar reminder two to four weeks before every certificate expires.
- Send renewal notices to a shared team mailbox, not one person's inbox.
- Keep a list of every domain and subdomain that has its own certificate.
- Turn on automatic renewal wherever it is offered, and test that it works.
- Use monitoring that checks your certificate from the outside and warns you days in advance.
Common questions
Is an expired certificate a security breach?
Not by itself. It means browsers no longer trust the connection, so it should be fixed quickly, but it does not mean your site has been hacked. If the warning appears together with unexpected content, run a malware check too.
How long does a renewal take?
Automatic and free certificates are often ready in minutes. Certificates that need company validation can take a few days, so renew those early.
Can I just tell visitors to click "Proceed anyway"?
No. It teaches people to ignore real warnings, and many will simply leave. Fix the certificate instead.