When Your SSL Certificate Expires Quietly

What the visitor actually sees

Not a small icon change. A full-screen interstitial, in alarming language, that has to be actively dismissed before the site loads at all. The wording varies by browser and the substance is consistent: this connection is not private, attackers might be trying to steal your information.

For a business asking people to submit their name, address, and phone number, that is close to the worst possible first impression. Most visitors do not click through it. Many assume the business has been compromised rather than that a renewal failed, and some tell other people.

The failure is total rather than partial, which is what separates it from most website problems. A slow site loses some enquiries. An expired certificate loses nearly all of them for as long as it lasts.

Why automatic renewal fails

Modern certificates renew automatically and usually do. The failures are unglamorous and share a common feature: nothing tells you.

• The validation challenge cannot complete. Renewal requires proving you still control the domain, usually by serving a file or answering a DNS query. A firewall rule, a redirect added since the last renewal, or a security plugin blocking the path will fail it silently.
• DNS changed. The domain was pointed elsewhere, a record was edited, or nameservers moved. The renewal process looks for something that is no longer where it expects.
• The scheduled task stopped. Renewal runs on a timer. Server migrations, control panel changes, and account suspensions can leave the timer disabled without anyone noticing.
• The hosting account lapsed. A failed payment suspends the account, which stops the renewal, which expires the certificate a few weeks later. The second failure is usually the one that gets noticed.
• A paid certificate was never set to renew. Purchased certificates are frequently annual and manual. The reminder goes to whoever bought it, who may no longer work there.

The pattern is the same one behind domain renewal failures: an automated process that has been working for years stops, and the only alert goes to an address nobody reads.

The failure that is harder to spot

Certificates are validated through a chain, and the intermediate links in that chain expire on their own schedule. A site can have a perfectly valid certificate and still fail for some visitors because an intermediate was not updated on the server.

This one is genuinely confusing because it is inconsistent. Newer browsers may load the site fine while older devices and some applications refuse it. The business tests it, sees no problem, and concludes the customer is mistaken. Checking the full chain rather than just the certificate is what separates a real test from a glance at the address bar.

What it costs in the first hour

Every enquiry that would have arrived, plus a proportion of the people who will not return. Search crawlers hitting the site during the outage record the failure. Any form, booking tool, or payment flow stops working. Links shared in advertising lead to a warning rather than a landing page, so paid traffic is being bought and discarded.

Because it is total, the arithmetic is simple. Take your daily enquiry count and treat it as lost for the duration. For most service businesses a day of that is a number worth several years of the monitoring that would have prevented it.

Monitoring it properly

• Check expiry weeks ahead, not on the day. A warning at thirty days and again at seven leaves time to fix a failed renewal calmly.
• Validate the whole chain, not just the leaf certificate, so intermediate problems surface before customers find them.
• Check from outside your own network, since local caching can show you a working version of a site others cannot reach.
• Send the alert to someone who can act. A notification reaching the owner on a Sunday creates awareness without creating a fix.
• Confirm renewal actually happened, rather than assuming that no news means success. Silent processes fail silently.

The check worth doing today

Open your site and look at the certificate details, which every browser exposes in a few clicks. Note the expiry date. Then answer three questions: is renewal automatic, who is notified if it fails, and has anyone verified that the renewal process still runs since the last time the site or server changed.

Most businesses can answer the first and not the second or third. That gap is the whole problem, and it is the same gap covered in what the padlock actually means, where letting a certificate lapse is the failure with by far the largest consequences.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.