Why SSL certificates expire and what happens when they do

A certificate is not a one-time purchase that makes your site secure forever. It is a dated statement that a trusted authority checked, on a particular day, that you controlled this domain. Because that statement goes stale, every certificate carries an end date, and browsers enforce it strictly. SSL certificate expiry is therefore one of the few website failures with an exact, knowable date attached, which makes it both entirely avoidable and embarrassingly common.

This article explains why the lifetimes exist, why they keep getting shorter, and what actually breaks when the date passes.

Why certificates have an expiry date at all

Three practical reasons sit behind the limit.

First, information goes out of date. Domain ownership changes, companies close, hosting moves. A certificate issued five years ago may be vouching for a situation that no longer exists.

Second, keys leak. Private keys end up in old backups, on decommissioned servers, in a repository someone made public. A shorter lifetime limits how long a stolen key remains useful.

Third, revocation does not work well. When a certificate must be cancelled early, browsers cannot reliably be told in time. Short lifetimes are the industry's blunt substitute: a bad certificate stops working soon regardless.

Lifetimes keep getting shorter

Certificates once lasted three to five years. The maximum fell to two years, then to roughly one year, and browser and certificate authority bodies have agreed on a path to much shorter maximum lifetimes over the coming years. Free automated certificates such as those from Let's Encrypt already run on a 90-day cycle.

The direction of travel is clear and it has one practical implication: manual renewal is becoming unworkable. A yearly reminder in someone's calendar might survive; a renewal every few weeks will not. Any site still renewing by hand should plan to automate before the interval becomes painful.

What visitors see on the day it lapses

There is no gentle degradation. Browsers show a full-page interstitial warning that the connection is not private, with the site content hidden behind it. On Chrome the wording mentions an invalid certificate and an expiry date; other browsers are similar.

The effect on a business site is severe because of what the screen implies. Visitors do not read it as “the administrator forgot to renew”. They read it as “this site may be fraudulent”, which is exactly what the warning is designed to convey. Many people close the tab immediately, and some tell others that your site has been hacked.

Search engines will also encounter the error when crawling, and if the situation persists, pages can drop out of results until access is restored.

What else breaks besides the website

The website is the visible casualty. The quiet ones cost more.

• Payments: gateway callbacks and webhooks are machine-to-machine requests with no human to click through a warning. They simply fail, so orders may be paid but never marked as paid.
• Mobile apps: an app talking to your API stops working entirely, often with an unhelpful generic error, and app stores will not let you push a fix within the hour.
• Integrations: courier tracking, accounting sync, CRM connections and WhatsApp or SMS notification services all use HTTPS calls that now fail.
• Mail servers: if the expired certificate also covers your mail hostname, secure connections from mail clients can break, which looks like an email outage.
• Scheduled jobs: any background task fetching a feed or posting to an API over HTTPS will error, sometimes silently.
• Advertising and analytics: ad platforms may disapprove landing pages that fail security checks, pausing campaigns while you are already losing traffic.

Because these fail independently, restoring the certificate does not automatically catch up missed webhooks. Plan to reconcile payments and orders for the outage window.

Why renewals get missed

Almost always one of these:

1. The renewal notice goes to a mailbox nobody reads, often an address belonging to a former employee or an agency.
2. The certificate was renewed with the authority but never installed on the server, so the old one is still being served.
3. It was installed on one server but not on the load balancer, CDN or mail server that also presents it.
4. Automatic renewal is configured but has been failing quietly for weeks, and nothing was watching.
5. A new subdomain was added to the site but not to the certificate, so that hostname shows a warning even though the main domain is fine.
6. The domain itself lapsed, so validation for the certificate could not complete.

Notice how many of these mean a certificate technically exists but is not the one your server is presenting. That is why checking the live site matters more than checking your inbox.

Monitoring so the date never surprises you

• Use an external certificate monitor that connects to your site and reads the expiry date, alerting at 30, 14 and 7 days.
• Monitor every hostname separately: the bare domain, www, API subdomains, staging and mail.
• Send alerts to a shared team address, not a personal one, and to at least two people.
• Check the certificate yourself by clicking the padlock in the browser and reading the validity dates, which takes ten seconds.
• Record every certificate in your site documentation with its hostname, authority, renewal method and expiry date.
• Re-check after every server migration, because certificates do not always travel with the site.

Check your expiry date today

Open your site, click the padlock and note when the certificate runs out. If it is a manual certificate expiring within a few months, decide now whether to move to an automated one and who owns the renewal. If you would like the certificates on your domains monitored and renewed as part of a managed setup, our team covers this with our Linux hosting plans.

Frequently asked questions

What happens to my website the day the SSL certificate expires?

Visitors see a full-page browser warning instead of your content, and machine-to-machine connections such as payment callbacks and app requests fail outright.

Can visitors just click through the warning?

Usually they can, but most will not, and doing so trains customers to ignore genuine security warnings. Treat the site as down until the certificate is replaced.

Does an expired certificate mean my site was hacked?

No. It only means the certificate's validity date has passed. The warning looks alarming because browsers cannot tell the difference between a lapsed certificate and an attack.

Is a paid certificate more reliable than a free one?

Both provide the same encryption strength. Paid certificates may offer longer validation types and warranties, but what determines reliability in practice is whether renewal and installation are automated and monitored.