What Happens When a Website Certificate Expires?

When your website certificate expires, visitors see a full-page browser warning that reads "Your connection is not private" or similar, blocking access to your site. Most visitors leave immediately. APIs and integrations that connect to your domain will fail. The site itself is still online, but browsers refuse to display it until you renew and install a new certificate.

What does a visitor see when they try to reach your site?

Browsers will no longer trust an expired certificate, and visitors will be displayed a warning (networksolutions.com). Chrome, Firefox, and Safari all display full-page warnings with slightly different wording (1pane.io). Chrome typically shows NET::ERR_CERT_DATE_INVALID. Firefox displays SEC_ERROR_EXPIRED_CERTIFICATE. Safari follows a similar pattern.

The warning is not subtle. Every visitor hits a full-page "Your connection is not private" screen and most of them leave immediately (kapient.com). While some browsers offer an "Advanced" button that allows users to proceed anyway, the vast majority of visitors will not do this.

APIs, microservices, or database connections that rely on TLS may fail, causing broader application errors (expirationreminder.com). Payment gateways, third-party integrations, and automated scripts that rely on HTTPS connections to your domain will throw certificate validation errors and stop working. Unlike a human visitor, these systems will not try to bypass the warning.

What does it cost you?

Nearly one in four respondents said their most significant certificate incident cost more than $250,000 (helpnetsecurity.com). The range depends on the size of the business and how quickly the issue is caught. For SMBs, downtime can cost anywhere from $140 to $1.7K per minute through lost revenue, lost productivity, and recovery time (sectigo.com).

The financial hit comes from multiple directions at once. E-commerce sites lose every transaction during the outage. If your agency is running paid Google Ads or Meta Ads campaigns to a landing page with an expired certificate, every click is a wasted ad budget spend that lands on a browser warning page instead of a converting page (dev.to). Support teams field confused tickets. DevOps scrambles to diagnose and fix the issue.

Some 34% of companies experienced a service outage caused by an expired certificate, while nearly three-quarters experienced at least five hours of downtime from certificate issues over the past year, including 21% that experienced 25 hours or more. The longer it takes to identify the problem and issue a replacement certificate, the higher the cost climbs.

Search engines like Google penalize unsecured websites, and an expired SSL certificate can tank rankings overnight. Recovery can take weeks or months, even after the certificate is renewed.

Why auto-renewal still fails

Certificates are issued with auto-renewal turned on in most hosting environments. The renewal should happen automatically 30 days before expiration. The failure happens silently 30 days before expiry, and by the time your site is showing a certificate warning, the renewal has actually been failing for weeks.

The A record in your DNS points to a different IP than the server where your cPanel account is hosted, and this is the single most common cause. The certificate authority tries to validate your domain ownership by connecting to a specific URL on your server. If DNS points elsewhere, that check fails and the renewal is rejected.

The orange cloud in Cloudflare is routing the certificate authority's validation request away from your actual server, so you should temporarily switch to DNS-only mode while AutoSSL renews. Cloudflare proxies requests through its own network, and Let's Encrypt cannot reach the origin server to validate the domain.

The most common culprits are changed file permissions, web server configuration updates that break HTTP validation, DNS changes that prevent domain verification, and renewal scripts that fail silently without notification. A single firewall rule added months earlier can block port 80, which is required for HTTP-01 validation. An .htaccess redirect can intercept the validation request before it reaches the temporary file the certificate authority is looking for.

Certbot obtains the new certificate files but does not automatically tell Nginx to use them, and without a post-renewal hook that reloads Nginx, the old (expired) certificate remains in memory even though the new certificate is on disk. This is a silent failure that only surfaces when visitors start reporting warnings.

Let's Encrypt certificates require DNS-based validation, and if the domain is no longer delegated to DNSimple's name servers, the automatic DNS challenge will fail. If you migrated DNS providers and forgot to update the delegation, renewal stops working immediately but you will not know until expiration.

Practical monitoring you can set up now

Do not rely on your hosting provider to alert you. Monitoring tools run scheduled validations from multiple global locations and alert your team before issues affect users. A dedicated certificate monitoring tool checks expiration dates daily and sends alerts at 30, 14, 7, and 1 day before expiration.

ActiScore's pricing (/pricing) includes TLS certificate health monitoring across all paid plans, starting at $79/month for 250 scans. The Security category checks SPF, DMARC, DKIM, and TLS certificate validity alongside HTTPS, CSP, and HSTS. You see the exact expiration date and days remaining for every domain you monitor. Alerts go out before the certificate expires, not after visitors start complaining.

Free alternatives exist. Free to use, no credit card, and by using an SSL certificate monitoring tool that continuously checks expiration dates and sends alerts before certificates expire. Services like NsLookup.io, SSL Monitor, and UptimeRobot offer free tiers that check one or a handful of domains. The free AI-visibility check (/check) also runs a TLS scan with no signup required, though it does not provide ongoing alerts.

Set calendar reminders as a fallback. If your certificate is valid for 90 days, set a reminder for day 60 and day 80. Manual checks take 10 seconds: open the site in Chrome, click the padlock in the address bar, view the certificate details, and confirm the expiration date. If you manage client sites, add this to your monthly checklist.

On March 15, 2026, public SSL/TLS certificate validity periods were reduced to just 200 days, representing a steep drop from the previous 398-day validity period. The cycle shortens again to 100 days in March 2027 and 47 days in March 2029. Manual renewal workflows that worked fine with annual certificates will not scale when certificates expire every six weeks. Automation is no longer optional.

Check your renewal logs now, before an outage forces you to. Log into cPanel and navigate to Security, then SSL/TLS Status. Look for domains marked with a renewal failure. In WHM, go to SSL/TLS and then Manage AutoSSL. Run a test renewal with the dry-run flag to surface errors without affecting the live certificate. The error message will tell you exactly what broke (DNS, port 80, permissions, rate limit, or something else). Fix that one thing, then re-test.

For managed WordPress or cPanel hosting, the guide (/guide) has a section on verifying that AutoSSL is enabled and where to check the renewal log. Most hosts surface this in the dashboard under SSL or Security. If the last renewal attempt failed, the log will show the reason. If the log is empty and the certificate is approaching expiration, auto-renewal is not running at all and needs to be enabled manually.