What Is an Expired HTTPS Certificate and How Do You Fix It?

You may have visited a website and suddenly seen a scary message saying:

Your connection is not private

or:

This site’s security certificate has expired.

For a website owner, this can be alarming. For visitors, it can make the website look broken, unsafe or even fraudulent.

Fortunately, an expired HTTPS certificate is usually a technical maintenance problem, not an indication that the website has been hacked.

What is an HTTPS certificate?

When you visit a website using HTTPS, your browser establishes a secure connection with that website.

The HTTPS certificate helps your browser confirm that it is communicating with the correct website and allows the connection to be encrypted.

Why do certificates expire?

Certificates are deliberately issued for limited periods.

This is actually a security feature.

For example, Let’s Encrypt currently issues certificates with a typical lifetime of 90 days. Shorter certificate lifetimes reduce the amount of time a compromised or incorrectly issued certificate could remain useful and encourage automatic renewal.

The problem isn’t that certificates expire.

The problem is when the renewal doesn’t happen.

Modern websites should ideally renew certificates automatically.

What happens when a certificate expires?

Google explains that certificate problems can prevent a browser from establishing a secure HTTPS connection.

This creates two major problems.

1. Visitors may not be able to access your website

A browser may block or strongly warn the visitor before allowing them to continue.

That means potential customers could simply leave.

2. It damages trust

Even if the website itself is perfectly legitimate, a large security warning can make visitors think:

“This website isn’t safe.”

For a business website, that can mean lost enquiries, lost sales and unnecessary damage to your reputation.

Does an expired certificate mean the website has been hacked?

No.

An expired certificate does not, by itself, mean that your website has been hacked.

It usually means the certificate’s renewal process failed, was never configured, or someone responsible for the website needs to renew it.

Of course, if a security warning appears unexpectedly, the website should still be checked rather than simply ignored.

How do you fix an expired certificate?

For most website owners, you don’t need to manually install a certificate yourself.

Your hosting provider normally manages the server where the certificate is installed.

The first thing to do is contact your hosting provider.

Tell them that the HTTPS certificate for your domain has expired or is showing as invalid and ask them to:

Renew and install a valid SSL/TLS certificate for the domain.

They should also check that the certificate covers the versions of the domain you actually use, such as:

• yourdomain.co.za
• www.yourdomain.co.za

They should then confirm that HTTPS works correctly across the website.

What should you ask your hosting provider?

If you’re not technical, you don’t need to know how certificates work.

You can simply send your hosting provider this message:

Hi, the HTTPS/SSL certificate for my website appears to have expired or is showing as invalid.

Please renew and install a valid SSL/TLS certificate for my domain and make sure it covers both the main domain and www version where applicable.

Please also check that HTTPS is working correctly and that the certificate is configured to renew automatically in the future.

Please confirm once this has been resolved.

That’s usually enough.

Make sure automatic renewal is enabled

This is the most important part.

Simply replacing an expired certificate fixes today’s problem.

Automatic renewal helps prevent the same problem from happening again.

Many modern certificate systems are designed specifically around automatic renewal. Let’s Encrypt, for example, provides free certificates and software that can automatically obtain and renew them.

If your hosting provider says they have renewed the certificate, ask:

“Is automatic renewal enabled?”

If the answer is yes, that’s good.

If they say the certificate has to be manually renewed every few months, ask why automatic renewal isn’t available.

Don’t just install a random certificate

If you’re not technically experienced, don’t download a certificate from a random website and try to install it yourself.

The certificate needs to be correctly issued for your domain and correctly installed on the server.

Your hosting provider is normally the safest person to handle this, or you can ask your developer to assist.

What if the certificate is valid but visitors still see warnings?

An expired certificate isn’t the only possible certificate problem.

Visitors can also receive warnings if:

• The certificate is issued for the wrong domain.
• The certificate doesn’t include the www version.
• The certificate chain is incorrectly configured.
• The server is presenting an old certificate.
• The website has HTTPS configuration problems.
• The visitor’s computer has an incorrect date and time.

So if your hosting provider says “the certificate is valid” but visitors are still seeing warnings, ask them to check the complete SSL/TLS configuration rather than simply issuing another certificate.

The bottom line

An HTTPS certificate is an important part of keeping a website’s connection secure and giving visitors confidence that they are communicating with the correct website.

Certificates expire by design.

The problem is failing to renew them.

If your certificate has expired:

1. Contact your hosting provider.
2. Ask them to renew and install the certificate.
3. Make sure it covers your domain and www version where applicable.
4. Ask them to check that HTTPS is working correctly.
5. Most importantly, ask them to enable automatic renewal.

You don’t need to understand the technical details to get this fixed.

Just make sure someone responsible for your website is making sure the certificate stays valid.