Guides / SSL certificate expiration

SSL certificate expiration: what happens and how to avoid it

An SSL certificate (also called a TLS certificate) is what lets a browser connect to your site over HTTPS and show the padlock. Every certificate has an expiration date. After that date, browsers stop trusting it.

What visitors see when a certificate expires

Most browsers replace the page with a full-screen warning that the connection is not private. Visitors have to click through several screens to continue, and many will simply leave. Your website is still running, but it looks broken or unsafe. Other things that depend on the certificate, such as API calls, payment pages and embedded widgets, can fail without any visible warning.

Why it still happens

Many hosts renew certificates automatically, but automatic renewal can fail. A DNS change, a moved server, a changed validation file or an expired payment method can all stop a renewal quietly. Certificates bought manually need a person to renew them, and that person may have left. Certificate lifetimes across the industry are also getting shorter, which means more renewals and more chances to miss one.

How to avoid it

• Know every certificate you are responsible for, including the ones on client sites.
• Check the expiration date, not only whether the padlock shows today.
• Get a reminder early enough to fix a failed renewal, for example 30 days before.
• Check again closer to the date, because the first reminder is easy to ignore.

HeyExpiry does the checking and the reminding for you. It reads the live certificate on each site you add and emails you at 30, 14, 7 and 1 days before it expires.

Next guide: domain expiration, the other date that quietly takes sites offline.