SSL Certificates, Expiry, and Why the Padlock Matters
An SSL certificate proves your site is what it claims to be and encrypts traffic between the visitor and your server. When it lapses, browsers do not show a subtle notice, they show a red interstitial that most visitors will not click past. It is one of the few failures that takes a working site fully offline in commercial terms.
How renewal usually works
Most sites use free certificates that auto-renew every 60 to 90 days through your host or a service on the server. When it works, you never think about it. Renewal is validated by proving you control the domain, either by serving a specific file at a specific URL or by publishing a DNS record.
Why it fails
- DNS moved. The domain now points somewhere else, so the validation check hits the wrong server.
- A redirect swallows the validation request. A rule forcing every URL to the homepage, or to www, blocks the path the validator needs.
- A firewall or security plugin blocks the validator.
- The certificate was manual and purchased. Paid certificates do not renew themselves; someone has to buy and install the new one, and that someone often left the company.
- The site is behind a proxy or CDN with its own certificate, and the two got out of sync.
The mixed content trap
A valid certificate does not guarantee the padlock. If your secure page loads an image, script, or font over plain HTTP, browsers report the page as not fully secure. Fix it by updating those URLs to HTTPS, not by ignoring the warning.
What to do this week
- Visit your site, click the padlock, and read the expiry date. Note it.
- Check that the www and non-www versions both work, and that HTTP redirects to HTTPS.
- Add uptime monitoring with certificate expiry alerts, which most monitoring services include free.
- Note who is responsible for renewal: your host, a plugin, or a person.
Thirty days of warning is the difference between a routine renewal and an emergency on a Saturday.
