Key takeaways
- An expired SSL certificate triggers a full-page browser warning that scares visitors away.
- First check your own device’s date and time, then renew or reissue the certificate in your hosting panel.
- When automatic renewal fails, a DNS change is the usual cause.
- Maximum certificate lifetimes are shrinking: 200 days since March 2026, falling to 47 days by March 2029. Manual renewal won’t keep up.
If your SSL certificate has expired, browsers now show visitors a warning such as “Your connection is not private” instead of your website. The fix is to renew or reissue the certificate through your host, confirm it’s installed on every version of your domain, and then make sure renewal happens automatically.
How do you know your SSL certificate has expired?
An SSL certificate proves your site is really yours and encrypts the connection between your site and each visitor. After its end date, browsers stop trusting it.
In Chrome, an expired certificate usually shows “Your connection is not private” with the code NET::ERR_CERT_DATE_INVALID. Other browsers use similar wording. Few visitors will click past it.
To confirm it, open the certificate details from the address bar and check the “Expires on” date. If every website shows the warning on your computer, check your device’s clock instead.
How do I fix an expired SSL certificate right now?
- Test from a second device. Open the site on your phone using mobile data. If the warning appears there too, the certificate really has expired.
- Log in to your hosting control panel. Find the SSL or TLS section for the site. Hosts that include free SSL certificates usually offer a “renew” or “reissue” button.
- Check the domain still points to your host. Free certificates are only issued when the domain reaches your site, so fix any recent DNS change first.
- Cover every version of the address. Include both the www and non-www addresses, plus any subdomains.
- For a paid certificate, renew with the seller, complete validation, then install the new files.
- Clear caches and test again. Purge any cache or CDN, then test in a private window.
If the warning changes to “Not secure”, some images or scripts still load over plain http. See our guide to the website not secure warning.
Why didn’t my certificate renew automatically?
Free certificates normally renew in the background. In our experience, when one expires anyway, it’s usually one of these:
- DNS changes. The domain was pointed at a new server or proxy, so the renewal check failed.
- Blocked verification. A security rule or redirect stopped the certificate authority reaching the verification file on your site.
- A paid certificate on manual renewal. The reminder emails went to someone who has left the business.
Paid certificates encrypt no better than free ones. Our comparison of free SSL vs paid SSL explains when paying makes sense.
Why are SSL certificates getting shorter?
In April 2025, the CA/Browser Forum (the group of certificate authorities and browser makers that sets the rules) approved ballot SC-081v3. Certificate issuers voted 25 in favour with none against, and Apple, Google, Microsoft and Mozilla all voted yes (CA/Browser Forum). It cuts the maximum lifetime of public certificates in stages (DigiCert):
Let’s Encrypt, which issues most free certificates, currently issues 90-day certificates. It plans to move its default to 64 days on 10 February 2027 and to 45 days on 16 February 2028. It says manual renewal is not recommended (Let’s Encrypt).
Renewal has to be automatic, and someone has to notice when automation fails.
How do I make sure it never happens again?
- Use hosting that renews certificates for you. Ask whether renewal is automatic for every domain.
- Monitor the expiry date. A certificate monitor can email you before it lapses.
- Tell your host before changing DNS. Moving email, adding a proxy or switching providers is when renewals break.
- Send technical emails to a shared inbox, not one person’s mailbox.
All of our hosting plans include free SSL and help from people who look after the setup. If you want stronger protection around it, our secure web hosting page explains the extra layers.
Frequently asked questions
Is it safe to visit a site with an expired SSL certificate?
Not entirely. The browser can no longer confirm the site’s identity, so the connection may not be protected. Avoid entering passwords or card details until the warning is gone. For a site you own, the bigger cost is lost trust and sales while the warning shows.
How long does it take to fix an expired SSL certificate?
With a free Let’s Encrypt certificate on hosting that supports it, reissuing usually takes a few minutes. It can take longer if the domain’s DNS points somewhere else, because that must be fixed first. Paid certificates take longer, since the seller has to validate the domain before issuing a new one.
Do I need to buy an SSL certificate every year?
Not for most small business sites. Free certificates from Let’s Encrypt give the same encryption as paid ones and renew automatically on good hosting. Paid certificates still suit some organisations that need extra validation or a warranty, but they now also need renewing more often under the new industry rules.
Why does my site say “Not secure” even with a valid certificate?
Usually because some images, scripts or forms on the page still load over http instead of https. The browser treats the page as only partly secure. Updating those links, or forcing https across the site, normally fixes it. Your host or web developer can find the mixed content quickly.
Sources
- Decreasing Certificate Lifetimes to 45 Days, Let’s Encrypt, published 2 December 2025, accessed 13 November 2026
- Ballot SC-081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods, CA/Browser Forum, April 2025, accessed 13 November 2026
- TLS Certificate Lifetimes Will Officially Reduce to 47 Days, DigiCert, published 16 May 2025, accessed 13 November 2026