Short answer: when an SSL certificate expires, nothing on your website is lost or changed. Visitors see a full-page warning that the connection is not private, and new visitors have no reason to click past it. Renewing the certificate removes the warning. Many hosts renew it automatically. If you see the warning, tell yours.
It tends to arrive out of nowhere. You open your own website, or a client mentions something odd, and instead of your home page there is a warning: “Your connection is not private”. It looks alarming, and the obvious fear is that something has gone badly wrong.
Usually it has not. One cause of that warning is an expired SSL certificate, which is among the more fixable things that can happen to a website. Knowing what happens when an SSL certificate expires takes most of the fright out of it.
What is an SSL certificate?
An SSL certificate is what puts the https at the start of your web address. In Google’s words, these certificates “encrypt the link between a site and your browser“. In plain terms, anything a visitor types into your contact form travels privately between them and your website.
Each certificate has an end date. Before that date, browsers trust it and say nothing. After it, they stop trusting it, and they say so loudly.
What happens when SSL certificate expires?
Nothing on your website changes. Your pages, photos, words and contact form are all still there, exactly as you left them. An expired certificate is not a hack, and it does not delete anything.
What changes is the way in. In Google Chrome, anyone visiting gets a full-page warning instead of your home page. The heading reads “Your connection is not private”. Underneath, it says “Attackers might be trying to steal your information” from your site, “for example, passwords, messages, or credit cards”. That is Chrome’s own wording, and other browsers say much the same.
The visitor then has a choice:
- A large “Back to safety” button, which takes them away from your site.
- An “Advanced” button, behind which sits a link to “Proceed to yoursite.co.uk (unsafe)”.
Someone who already knows you might click through. Someone finding you for the first time has no reason to.
On some websites there is no way past at all. If a site has told browsers to insist on a secure connection, using a setting called HSTS, the browser “does not offer the user a way to proceed“. Chrome simply tells the visitor they cannot visit the site right now.
Why it matters more in your line of work
Think about who is reading that warning. For most people it is a nuisance. For someone who has taken a while to work up to contacting a therapist, a page saying their information might be stolen is an easy reason to close the tab.
They will not email to tell you. They will not know it was a renewal date and nothing to do with you.
Why SSL certificates expire, and why it now happens more often
Certificates are given short lives on purpose. As the certificate company DigiCert explains it, the details in a certificate become less trustworthy the longer it lasts, and cancelling a bad one is unreliable.
In April 2025, the browser makers and the companies that issue certificates agreed to shorten the maximum lifetime in stages:
| Certificates issued | Longest they can last |
|---|---|
| Before 15 March 2026 | 398 days |
| From 15 March 2026 | 200 days |
| From 15 March 2027 | 100 days |
| From 15 March 2029 | 47 days |
Let’s Encrypt, which gives certificates away free, already issues ones that last 90 days. It has announced it will cut that to 64 days in February 2027 and 45 days in February 2028.
So renewing by hand once a year no longer works. It has to be automatic.
On my own hosting, almost every site uses a free Let’s Encrypt certificate that lasts about three months and renews itself before it runs out. When I checked all of them while writing this, every one of the 50-plus websites I host was in date, and the soonest was still a month from expiring.
Why does automatic renewal sometimes fail?
Automatic renewal works while everything around it stays put. When it fails, the cause is usually something ordinary:
- The domain name has been pointed somewhere new, so the renewal can no longer reach the website to check it.
- The website moved to new hosting, and the certificate was never set up again there.
- A certificate was bought separately years ago and never set to renew itself.
- Messages about a failed renewal go to an email address nobody reads. On cPanel hosting, account holders get notices about failed certificate requests by default, which only helps if someone sees them.
Let’s Encrypt also stopped sending reminder emails before certificates expire, on 4 June 2025, because more of its users now renew automatically. If you once relied on those emails, they are not coming any more.
I see the timing side of this whenever I set up a new site. The hosting asks for a certificate as soon as the account is created. If the domain is not pointing at the server yet, that first try fails and waits for the next scheduled run, which on cPanel happens overnight. On a new site in August, asking it to try again by hand had the certificate in place in about a minute and a half, rather than a day later.
None of this is anyone being careless.
Seeing the warning on your own website? What to do
Take a breath first. Nothing has been lost. Then work through these in order.
- Check the date and time on your device. Google says this kind of warning can appear “if your computer or mobile device’s date and time are inaccurate“. A wrong clock makes every secure site complain, not just yours.
- Check you are not on a Wi-Fi sign-in page. Places like cafés and airports make you sign in before you get online, and Google lists that as a cause too.
- Try your website on another device, ideally a phone on mobile data. If the warning only shows on one device or network, the problem is there, not with your website.
- If it shows everywhere, contact whoever hosts your website. Tell them the SSL certificate has expired, and send a screenshot of the warning. If you are not sure who hosts it, start with the company you pay for the website.
- Check again once they have renewed it. The warning goes, and your website is exactly as it was.
It is a renewal, not a rebuild.
How to check when your certificate runs out
You do not have to wait for a warning. On a computer, open your website in Chrome, select the small icon to the left of the web address, and open the connection details. From there you can view the certificate and the date it expires. Note the date and look again in a month or two. If it has moved forward, the certificate is renewing itself.
Or ask your host one question: does the certificate renew itself, and who hears about it if it does not?
A quick check for the rest of your website
An expired certificate is one of several things on a website that only get noticed when they stop. Last week I wrote about what happens when a domain name expires, and the same goes for contact forms that stop sending without telling anyone.
My free website checklist covers ten of these, including the warning browsers show before anyone reads a word of your site. It takes about 20 minutes.
If you would rather not keep track of any of this, my Pay Monthly website plans include the SSL certificate, secure UK hosting and weekly maintenance, so the renewals are my job. Feel free to get in touch if you would like a quick chat about it.
Frequently asked questions
Does an expired SSL certificate mean my website has been hacked?
No. An expired certificate means the date on it has passed, and nothing more. Your pages, images and settings are untouched, and nobody has got into your website because of it. The warning sounds frightening because a browser cannot know whether an out-of-date certificate is harmless or being misused, so it treats every expired certificate with the same caution. Chrome’s own explanation of an expired certificate says it “may be caused by a misconfiguration or an attacker intercepting your connection”, and it asks the visitor to check their computer’s clock. For your own website, the likely answer is the dull one: the renewal did not happen. Ask whoever hosts your website to renew it, and the warning disappears.
Will my website stop working if the SSL certificate expires?
Your website itself keeps running. It stays online, the pages are all there, and the contact form still exists. What stops is easy access to it. In Chrome, visitors meet a full-page warning, and have to select “Advanced” and then a link marked “unsafe” to get past it. Someone finding you for the first time has little reason to do that. On some websites, those using a security setting called HSTS, browsers offer no way past at all, so in practice the site cannot be reached until the certificate is renewed. Renewing the certificate fixes all of this at once. Nothing needs to be rebuilt or restored afterwards.
How long does an SSL certificate last?
It depends on when it was issued and who issued it, and the limit is shrinking. Under rules agreed by browser makers and certificate companies in 2025, a certificate issued from 15 March 2026 can last at most 200 days. From 15 March 2027 the limit falls to 100 days, and from 15 March 2029 to 47 days. Before that the maximum was 398 days, which is why many people think of renewal as a once-a-year job. Free certificates from Let’s Encrypt currently last 90 days, and Let’s Encrypt plans to cut that to 64 days in February 2027 and 45 days in February 2028. In practice, certificates now need renewing several times a year, which only works if renewal is automatic. If yours is renewed by hand, ask whoever looks after your website how they will keep up.
Do I have to pay for an SSL certificate?
Usually not. Let’s Encrypt describes itself as a free, automated and open certificate authority, and says anyone who owns a domain name can get a trusted certificate from it at zero cost. Many hosting companies use it to give every website a certificate that renews itself. On cPanel hosting, a feature called AutoSSL installs these automatically. Paid certificates still exist, and some organisations buy them for the extra identity checks that come with them. For a therapy practice or small business website, a free certificate gives visitors the same padlock and the same private connection. If your host charges separately for one, ask whether it renews itself. A certificate bought on its own and renewed by hand relies on someone remembering, and that gets harder as lifetimes shorten. My Pay Monthly plans include the certificate as standard.
Why does my website say “Not secure” instead of showing a full warning?
That is a different problem. Chrome shows “Not secure” beside the web address when a page does not use a private connection at all, usually because it loads over plain http rather than https. Google’s help page explains that “someone may be able to view and change the information that you send and receive through this site”, and that the site owner has to fix it by securing the site with HTTPS. An expired certificate behaves differently. Instead of a small label in the address bar, the whole page is replaced by a warning before your website appears. Both need fixing, and your host can usually fix either. If you see “Not secure”, check whether your web address starts with https. If it does not, ask your host to set it up.