SSL certificate expired: the short answer
- Every certificate has an end date. Once it passes, Chrome shows “Your connection is not private” and labels the site “Not secure”. Your site is not broken or hacked; replacing the certificate clears the warning.
- To check the expiry date, click the icon to the left of the address bar, open the certificate and read “Expires On”. Our free check also reads the certificate and shows the days remaining.
- The fix depends on who issues your certificate: re-run automatic renewal in your hosting control panel, renew and reinstall a certificate you bought separately, or ask the agency that manages your site.
- Certificates are getting shorter by industry rule: a maximum of 200 days since March 2026, 100 days from March 2027 and 47 days from March 2029. Renewing by hand will stop being practical, so use automatic renewal plus outside monitoring.
What an SSL certificate is, and what visitors see when it expires
An SSL certificate (strictly, a TLS certificate) is your website’s ID card. Any address that starts with https:// has one. An independent issuer, called a certificate authority, confirms that the site really belongs to that domain, and the certificate lets the browser encrypt everything sent between the visitor and you.
Like any ID, it has an expiry date. Once that date passes, browsers can no longer confirm the site is genuine, so they block the page with a warning. Visitors read that as “this site is dangerous”, and most leave.
| Browser | What visitors see | Notes |
|---|---|---|
| Chrome | “Your connection is not private” | “Not secure” in the address bar; error code NET::ERR_CERT_DATE_INVALID |
| Safari (Mac, iPhone) | “This Connection Is Not Secure”, “Website Not Secure” or “Not Secure” | Some versions show a full page titled “This Connection Is Not Private” |
| Edge | “Your connection isn’t private” | Built on the same engine as Chrome, with the same error codes |
If only your own device shows the warning, its date and time may simply be wrong. Chrome then says “Your clock is behind” or “Your clock is ahead”. If other devices see the warning too, the problem is on the website.
How to check your SSL certificate expiration date
The quickest way is our free 30-second check: enter your domain and it reads the certificate and tells you how many days are left. No sign-up. To see it with your own eyes, use the browser.
- 1
Chrome (desktop)
Open your site and click the icon to the left of the address (“View site information”). Click “Connection is secure”, then “Certificate is valid”. In the window that opens, look under “Validity Period” for “Expires On”.
- 2
Safari (Mac)
Open your site, then choose Safari > Connection Security Details from the menu bar to see the certificate and its end date. In older versions, click the padlock in the address field and choose Show Certificate.
- 3
If the warning is already showing
In Chrome, click “Not secure” in the address bar to reach the certificate details. In Safari, click Show Certificate in the warning. If the end date is in the past, expiry is your problem.
- 4
Check both www and non-www
Open example.com and www.example.com separately. It is common for one to be covered and the other to be expired or missing.
How to fix an expired SSL certificate, by situation
The fix is always the same two things: get a new certificate issued, and get it installed on the server. Who does that depends on your setup.
| Your situation | What to do | Watch out for |
|---|---|---|
| Shared or managed hosting with free automatic certificates (Let’s Encrypt and similar) | Open the SSL/TLS section of your hosting control panel and turn automatic renewal on. If it shows a failure, remove the certificate and issue it again | It can only be issued if your domain’s DNS points at that host |
| A paid certificate you bought separately | Renew with the seller, receive the newly issued certificate, then install it on the server | Paying is not enough: nothing changes until the new file is installed. Some certificate types take days to validate |
| A CDN or website builder | Usually automatic. Check the domain’s connection status in the dashboard and that your DNS records still match their instructions | An expired domain registration or a changed DNS record is the usual cause |
| An agency or freelancer manages the site | Contact them with the message below | Ask whether certificate renewal is part of your maintenance agreement |
A message you can copy: “Our website (https://www.example.com) is showing an expired SSL certificate warning. Please renew and install the certificate as soon as possible. Please also confirm whether it is set to renew automatically, when it next expires, and which email address receives renewal notices.”
Once it is installed, reload the page and confirm that the warning is gone and the new end date is shown. Your visitors do not need to do anything.
Why automatic renewal still fails
Plenty of sites “on auto-renew” still expire. Automatic renewal fails quietly when one of its conditions changes:
- DNS changed. You moved hosts or added a CDN, so the old server can no longer prove it controls the domain.
- The domain itself expired. No valid domain registration, no certificate.
- The payment card expired. The charge for a paid certificate or the hosting plan failed, and renewal stopped with it.
- www or non-www is not covered. The certificate lists only one of the two names, so the other shows a warning.
- Notices went to someone who left. Renewal and failure emails were going to a former employee’s personal inbox.
Let’s Encrypt stopped sending expiration reminder emails on June 4, 2025. If you were counting on an email before the certificate lapses, that safety net is gone.
Certificate lifetimes are shrinking: 200, 100, then 47 days
The CA/Browser Forum, the body of certificate authorities and browser makers that sets the rules for public certificates, voted in April 2025 (Ballot SC-081v3) to cut the maximum lifetime of a certificate in stages.
| Certificates issued | Maximum validity |
|---|---|
| Before March 15, 2026 | 398 days |
| From March 15, 2026 | 200 days |
| From March 15, 2027 | 100 days |
| From March 15, 2029 | 47 days |
A once-a-year renewal has already become twice a year, and by 2029 it will be about eight times a year. Let’s Encrypt, a free issuer that many hosts use, has issued 90-day certificates since it launched and has announced that its default will drop to 64 days in February 2027 and 45 days in February 2028.
Shorter lifetimes limit the damage when a key is stolen or a certificate is issued by mistake. The trade-off is that renewing by hand, with a calendar note and a file upload, stops being realistic. When you next choose a certificate or a host, make automatic renewal a requirement.
How to make sure your certificate never lapses
- 1
Turn on automatic renewal
Confirm in your hosting control panel that the certificate renews automatically. If you install a paid certificate by hand, ask your host or agency whether you can move to an automated method at the next renewal.
- 2
Monitor from the outside
Automatic renewal fails silently, so have something independent check the live certificate every day. Security Ready’s paid plans check your certificate daily and alert you before it expires.
- 3
Add calendar reminders
Put “check certificate expiry” in a shared calendar 30 days and 7 days before the end date. Let’s Encrypt’s own guidance is to renew when about a third of the lifetime is left, which is 30 days for a 90-day certificate. If yours has fewer than 30 days and has not renewed, automation has failed.
- 4
Send notices to a shared mailbox
Register a shared address, read by more than one person, with your host, domain registrar and certificate seller. Note the expiry date of the payment card too.
Similar warnings that are not an expired certificate
If the end date is still in the future and you see a warning anyway, it is usually one of these.
Name mismatch
The domain on the certificate is not the address the visitor opened. Chrome’s code is ERR_CERT_COMMON_NAME_INVALID. The classic case is a certificate that covers www but not the bare domain, or the reverse.
Incomplete chain
The server is not sending the intermediate certificate that links yours to the certificate authority. The site may open on a laptop but fail on some phones. Reinstalling the certificate with its full chain fixes it.
Mixed content
The page is https but loads images or scripts over plain http. The padlock disappears or parts of the page are blocked, though there is no full-page warning. Change those addresses to https.
Old TLS versions
The certificate is valid, but the server only offers TLS 1.0 or 1.1. Safari marks such sites “Not Secure”. Enable TLS 1.2 or later in the server settings.
These are hard to spot by looking at the page. The 30-second check covers the certificate along with email spoofing protection and basic settings, and the free in-depth scan goes further into the server itself. A certificate warning is not a sign of a break-in, but if your site is showing pages you never created, read Is my website hacked?
Frequently asked questions
Does an expired SSL certificate take my website offline?
No. The site is still running, but browsers put a warning page in front of it. Visitors can click through, yet most turn back. The warning disappears as soon as a new certificate is installed.
Is it dangerous to leave a certificate expired?
Browsers can no longer confirm that visitors are talking to the real site. It also teaches your customers to click past warnings, which makes them easier to fool with a fake site. If you have a contact form or login, fix it promptly.
How do I fix “Your connection is not private” as the site owner?
Open the certificate from the warning and read the error code. NET::ERR_CERT_DATE_INVALID with a past end date means the certificate expired: renew and install it. ERR_CERT_COMMON_NAME_INVALID means the certificate does not cover that address.
How much does it cost to renew an SSL certificate?
Free certificates such as Let’s Encrypt cost nothing to renew, and most hosts include them. Paid certificates vary by type and seller, so check your provider’s current price list.
I renewed, so why is the warning still there?
Most often the new certificate was issued but never installed. Sometimes only www or only the bare domain was updated, or a CDN is still serving the old one. Test from a second device and another network.
Are free certificates less secure than paid ones?
The encryption is the same. Paid certificates differ in how much the issuer verifies about your organization, and in support and warranty. For avoiding expiry, easy automatic renewal matters more than price.
Does Security Ready renew the certificate for me?
No. Renewal happens at your host or in your own control panel. Security Ready checks the certificate from the outside every day and tells you, with fix instructions, when expiry is near or something is misconfigured.
See where your own site stands — free
The free in-depth scan checks your site from the outside against thousands of known weaknesses and tells you how to fix each one. No payment details needed. For businesses; scans only with the owner's authorization.