Your SSL certificate expired and the site says Not Secure: fix it now, and for good
·2 min read
An expired SSL certificate is a small failure that turns visitors away instantly. How to fix it in minutes, and how to set it up so it renews itself and warns you before it runs out.
A message first thing in the morning: "What's wrong with your site? Chrome says it isn't safe." You open it and get the red screen: "Your connection is not private". Most of the time the reason is simple: the SSL certificate has expired.
Nothing is lost, but a visitor who sees that screen leaves straight away, and orders and contact forms stop until it's fixed.
Check that it really expired
Click the warning icon next to the address, open the certificate details and look at Valid until. Or put the domain into any online SSL checker and it shows the expiry date.
If the certificate is still valid but the warning remains, it is usually one of two things:
- The certificate doesn't match the name, for example it was issued for
example.combut visitors usewww.example.com. - The intermediate certificate is missing, so some browsers or older phones complain while others don't.
Fix it now
It depends on where the site runs:
- Hosting with a control panel (cPanel, DirectAdmin…): find the SSL or Let's Encrypt section and reissue or renew.
- Behind Cloudflare: check the SSL mode. On "Full (strict)", an expired certificate on your own server still breaks the site, so renew the one on the server.
- Your own VPS with Let's Encrypt: run certbot's renew command and reload the web server. If it fails, read the message carefully: most often the domain now points somewhere else, or port 80 is blocked so Let's Encrypt can't verify the domain.
- A paid certificate: renew it with the provider, then install the new certificate files on the server.
Why it didn't renew itself last time
Let's Encrypt certificates only last 90 days, so they have to renew automatically. They "forget" because:
- The renewal cron job was never set up, or got lost when the site moved servers.
- Renewal worked, but the web server was never reloaded, so it kept serving the old certificate.
- Port 80 was closed in a firewall clean-up.
- Whoever set it up has left, and nobody knows how the certificate was issued.
Make sure it doesn't happen again
- Use a web server that handles SSL for you. Caddy and Traefik issue and renew certificates on their own, no separate cron needed.
- Turn on an expiry alert. Many free uptime monitors include an SSL check that emails you 14 or 30 days ahead. Five minutes of setup that saves a lot of trouble.
- Write down how the certificate is issued in your operations notes: which tool, where it runs, who has access.
- Watch the domain too, not only SSL. An expired domain is worse, so turn on auto-renew at your registrar as well.
Want to know how many days your SSL has left, and whether any security headers are missing? Send me your domain for a free quick scan.
Sound like your system?
A 2–4 day Health Check tells you what to fix first and what can wait.
