An expired SSL certificate is one of the most avoidable ways for a website to go down, and one of the most common. Nothing is wrong with the server, the code or the database. The site simply stops being trusted, and every visitor is met with a full-page warning that the connection is not private. Most of them leave and do not come back.
This guide explains why certificates expire, why it keeps happening even to teams with automation, and how to make sure it never catches you out.
What an SSL certificate does
An SSL (or TLS) certificate lets a browser confirm that it is talking to your real site, and encrypts what passes between them. It is what puts the padlock and https:// in the address bar. Every certificate has an expiry date, and after that date browsers refuse to trust it.
Certificates are deliberately short-lived. Lifetimes have been getting shorter for years, and free certificates from services such as Let’s Encrypt last only 90 days. A short lifetime limits the damage if a certificate is ever stolen, but it means renewal is a constant, recurring job.
What visitors see when it expires
Browsers do not quietly carry on. They show a full-page interstitial, with wording such as “Your connection is not private” or “Warning: potential security risk ahead”, and hide the way through behind an “Advanced” link that most people will not click. Mobile browsers and apps are often stricter still, and an API client simply fails with a certificate error.
The effect is the same as the site being offline, with some extras:
- Visitors are told, in alarming language, that your site may be dangerous.
- Browsers and search engines may drop the pages from results until it is fixed.
- Anything that calls your site, such as a mobile app, a webhook, a payment callback or a partner integration, starts failing too.
- Email can be affected if the same certificate secures a mail server.
Why certificates still expire, even with auto-renewal
Automatic renewal has made expiry rarer, but not impossible. The renewal process is itself a scheduled job, and like any scheduled job it can stop without telling anyone. The usual causes are:
- The renewal job stopped running. The cron entry or timer was lost in a server rebuild, or the service was disabled.
- The renewal runs but fails. The domain’s DNS changed, a firewall now blocks the validation request, the web server configuration moved, or the account that holds the certificate was closed.
- The certificate was renewed but not reloaded. The new file is on disk, but the web server is still serving the old one in memory until it is restarted.
- The certificate is manual. A paid certificate bought for a year, with a reminder going to an email address nobody reads.
- A forgotten place. The main site is fine, but a subdomain, an API address, a staging site or a load balancer has a different certificate that no one is watching.
- A change in ownership. The person who set it up has left, and the renewal notices go to them.
A pattern worth noticing: almost every one of these is a quiet failure. The renewal does not complain, it just does not happen, and nobody finds out until the day the certificate runs out.
How to prevent it
1. Automate renewal, and know where it runs
Use a certificate authority and client that renew automatically, such as Let’s Encrypt with Certbot or your host’s built-in tool. Know which machine does the renewing and what schedule it uses. Many setups try to renew daily and only act when the certificate is within 30 days of expiry, which leaves a month to fix a failure.
2. Watch the renewal job itself
The renewal is a scheduled job, so monitor it like one. Have it check in to a heartbeat check when it succeeds. If it stops running, or starts failing, the missing check-in tells you weeks before the certificate would have expired. For example, with Certbot:
The --deploy-hook reloads the web server only after a successful renewal, which covers the “renewed but not reloaded” case. See how to monitor cron jobs for the general approach.
3. Monitor every address that serves HTTPS
List every domain and subdomain that visitors or software depend on, and give each a website check. Pingvella requests the address over HTTPS every 5 minutes, and an expired or invalid certificate counts as down, so you are alerted within minutes of the certificate failing, and told again when it is fixed.
4. Send renewal notices somewhere shared
Register certificates, domains and hosting under a role address that more than one person reads, not an individual’s inbox. Check who gets the notices whenever someone joins or leaves.
5. Check the renewal works, before you need it
Most tools have a dry-run mode, such as certbot renew --dry-run. Run it after any change to the server, the DNS or the firewall.
If it has already expired
- Renew or reissue the certificate straight away. For Let’s Encrypt, run the renewal and read any error it gives.
- Reload or restart the web server, load balancer or CDN so it picks up the new certificate.
- Confirm in a browser, and check any other addresses that share the certificate.
- Find out why the automation failed, and add a monitor so the next failure is reported. The website down checklist covers the other things worth ruling out.
Know within minutes
Pingvella can watch your site’s address and the job that renews its certificate, with alerts by email, Slack, Discord, Microsoft Teams, Telegram or webhook. Every account has five website checks and three heartbeat checks free. Start with website monitoring.
Common questions
Does Pingvella notice an expired SSL certificate?
Yes. A website check that meets an expired or invalid certificate counts as down, so you are alerted within minutes of the certificate failing, and told again when it is fixed.
What counts as my website being down?
Anything other than a successful 2xx response once redirects are followed: an error page, a timeout, a refused or dropped connection, an expired or invalid SSL certificate, or an address that no longer resolves.
How do I know if a cron job stopped running?
Cron doesn’t report missed or failed runs, so have the job check in to Pingvella when it finishes. If the check-in doesn’t arrive on schedule, the check goes down and you are alerted. See the guide to monitoring cron jobs.
There are more answers on the FAQ page.