My SSL certificate has expired: what happens now
An expired certificate does not break the site: it breaks the trust the browser grants it. Visitors get a full-screen warning advising them to leave, and most do. Putting it right is quick; the real question is why renewal, supposedly automatic, did not happen.
What actually changes
The certificate does two things: it encrypts the connection, and it attests that the server answering really belongs to the requested domain. Once the validity date has passed, the browser can no longer verify the second part and refuses to show the page without explicit confirmation from the visitor.
The consequences go beyond display. Applications that call your site — a carrier module, business software, a payment service, an indexing robot — usually refuse the connection with no way around it. An expired certificate therefore also stops automated flows whose execution nobody watches.
Why automatic renewal failed
-
The domain no longer points to the right place
Automatic validation checks that you control the domain by querying the server it points to. After a nameserver change, validation fails silently for weeks before the certificate expires.
-
A redirect blocks validation
A rule redirecting all traffic to HTTPS or to another address also intercepts the technical path the certificate authority uses to verify the domain.
-
Renewal was never automatic
Some paid certificates are annual and manual. Nobody reads the warning address, and the deadline passes without anyone being told.
-
A subdomain was forgotten
The certificate covers a precise list of names. Adding a subdomain without including it produces a warning on that name alone, which looks like an intermittent problem.
-
The renewal task is stopped
On a server you administer, renewal depends on a scheduled task. If it was disabled during other work, nothing restarts it.
After service is restored
Once the certificate is renewed, two checks are worth the detour. First the certificate chain: a valid certificate installed without its intermediate works on desktop browsers and fails on some phones, producing an apparently random problem. Then the next expiry date and the address the warning will be sent to — the only way to stop the situation repeating.
- Check the HTTPS redirect is in place, otherwise both versions of the site coexist.
- Check that automated calls to your site have resumed: an interrupted flow does not always restart by itself.
Carry on with the right page
-
Moving a site to HTTPS
The full procedure, including redirects and mixed content.
-
SSL and TLS explained
What the certificate really guarantees, and what it does not.
-
Domain names
If the expiry relates to the domain or nameservers rather than the server.
-
Web hosting
How I organise automatic renewal on the sites I look after.
Describe your need in one minute
A few targeted questions so I can reply with an estimate rather than another questionnaire.