Website shows as not secure: expired or wrong SSL certificate

Telling the cases apart

• "Your connection is not private" with NET::ERR_CERT_DATE_INVALID: the certificate has expired. The browser puts a wall in front of the site.
• NET::ERR_CERT_COMMON_NAME_INVALID: the certificate is for another name. It happens when it covers site.com and not www.site.com, or after a move.
• "Not secure" next to the address, with no wall: the site opens over http with no certificate, or the redirect to https is missing.
• There is a padlock, with a warning: the page is on https and loads some image or script over http. This is mixed content, common on WordPress after an address change.

What to do now

If you have an online shop or a form with personal data, warn the people working with the site, and don't tell customers to click "proceed anyway". Teaching them to skip warnings is dangerous. Then call me: if the host supports Let's Encrypt, a new certificate can be issued in minutes.

Why manual renewal won't hold up any more

Certificates keep getting shorter. The CA/Browser Forum, which sets the rules, has decided these maximum lifetimes:

• 200 days for those issued from 15 March 2026;
• 100 days from 15 March 2027;
• 47 days from 15 March 2029.

Let's Encrypt, which issues 90-day certificates today, will move to 64 days from 10 February 2027 and to 45 days from 16 February 2028. So anyone renewing by hand, or who bought a yearly certificate to upload to the server, will have to do it several times a year, and sooner or later will forget.

Automatic renewal can also stop on its own: moved DNS, a redirect added to the site, a protected folder, a host that changed its control panel. The certificate stays valid for weeks and nobody notices until the day it expires.

What I do

1. I check the certificate on every name of the site, with and without www, and on linked services such as mail.
2. I issue a new one with automatic renewal on, and test that renewal really works.
3. I force https with a redirect and fix mixed content.
4. I set up an external check that warns before expiry.

With SitePing, the monitoring service I wrote, I see certificate expiry for the sites I look after. On the servers I run, certificates are automatic with Let's Encrypt: the plans are under Servers and hosting.

Frequently asked questions

Has the site been hacked?

Usually not: the connection warning is about the certificate. It is different from Google's red warning about a dangerous site. In that case, read the page on hacked websites.

Do I have to pay for a certificate?

For most sites, no. Let's Encrypt issues them free and nearly all hosts renew them automatically. Paid ones only make sense in particular cases, for instance if a contract or a customer asks for one.

How long does the fix take?

With access to the hosting or DNS, usually less than an hour. If the domain is held by someone who doesn't answer, it depends on when the access can be recovered.

Only I see the warning. What does that mean?

If the site works on other devices, check your computer's date and time: a wrong clock triggers the same error. It can also come from an antivirus that inspects connections.

Read more

• The service: Servers and hosting
• More pages like this: Websites with a problem