Your certificate expired and the browser is shouting at visitors
Nothing was deployed, nothing broke, and the site now warns every visitor away. A certificate reached its date and no one was watching for it.
Does this sound familiar?
This is the outage with no cause: no release, no traffic spike, no failure. A date passed, and browsers started telling people your site is unsafe.
- Visitors see "Your connection is not private" and leave
- Nobody is sure which certificates exist, or what renews them
- A renewal cron exists but nobody has checked that it ran
- The certificate was renewed by hand last time, by someone who has since left
What we do, in order
Roughly the first week. The sequence matters more than the speed.
We get the site trusted again
A working certificate first, before anything else is diagnosed. Visitors seeing a warning is the emergency; understanding why comes second.
We find every certificate you have
Across every domain and subdomain, with expiry dates. Businesses routinely find certificates they did not know about, and subdomains nobody remembers standing up.
We make renewal automatic, and verify it
Automatic renewal is standard; silent failure is equally standard. Renewal needs the challenge path to be reachable, which an nginx rule added months later can quietly break. We check that the renewal actually completes, not that the job is installed.
We watch the dates
Expiry is tracked per domain and alerts well before the deadline. A certificate should never be able to expire without somebody having been told twice.
Why this keeps happening
Automatic renewal usually works, and when it stops working it stops silently. The job runs, fails its challenge, exits, and writes to a log nobody reads — until 90 days later a browser makes the announcement for you. The failure is always weeks old by the time anyone hears about it.
Common questions
How do I fix an expired SSL certificate?
Issue a new one and load it. With Let’s Encrypt that is a single renewal command once the domain still points at the server, and the site is trusted again as soon as the web server reloads. The more useful question is why the automatic renewal stopped.
Why did my certificate not renew automatically?
Most often because the validation challenge could not reach the server: a redirect rule, a firewall change, or a configuration edit that no longer serves the challenge path. The renewal job still runs on schedule, fails, and logs it somewhere nobody looks.
How much notice should I get before a certificate expires?
Weeks, not days. Let’s Encrypt certificates last 90 days and renew at 60, which leaves 30 days of margin — enough to notice a broken renewal, but only if something is checking and telling you.
Does an expired certificate affect search rankings?
Indirectly and quickly. Search engines prefer HTTPS, but the immediate damage is behavioural: visitors meet a full-page browser warning and leave, and that bounce is measured.