What Happens When Your SSL Certificate Expires
Sagar Sethi is the founder of Web Hosting People and Xugar, and the author of The Business Knight.
Published 19 October 2026 Last reviewed 19 October 2026 Website security and SSL
An expired certificate does not switch your website off. It stops the browser trusting it. The visitor gets a full page warning before your site loads, the address bar shows a warning instead of a padlock, and the only way through is a link inside an advanced options panel that most people never open.
Nothing else has changed: the certificate carries a validity date, the date has passed, and the browser cannot tell whether the same people still run the site. One of the causes below cannot be fixed by renewing anything, which is why the diagnosis comes before the purchase.
What the visitor sees
A warning page, before your content, on every page of that hostname. The wording differs between browsers and none of it is subtle: the connection is not private, information sent to the site could be read or changed, and the site may be impersonated.
The visitor has two choices. Close the tab, which is what most people do, or open the advanced panel and follow a link offering to continue to an unsafe site. That is a strange thing to ask a customer to do before they can read your opening hours.
Two details change how urgent this is. The warning is per hostname, not per page, so every page at the address people use warns, including the checkout. And there is no partial state: the browser treats the whole exchange as untrusted.
What stops working behind the warning
Four things fail at once.
Payments and bookings. Most payment providers require an HTTPS endpoint, and a browser that does not trust the certificate will not finish the exchange. Card payments fail, and from your side it looks like a broken store rather than a certificate problem.
Forms and logins. The page carrying the form does not load until the visitor clicks through a warning, and the ones who do are being told not to enter their details there. Most will not.
Integrations. Anything that calls your site over HTTPS and checks the certificate, whether a booking widget, a stock feed or an accounting link, refuses the connection. This failure takes longest to find, because whoever reports it is looking at the other system.
Everything you already published. Invoices, email signatures, printed material, QR codes and social profiles all point at the same hostname. Every one of them now leads to a warning.
Why a certificate expires
The expiry date is set when the certificate is issued. It is not a setting anyone can extend, and nothing on the site reminds you it is approaching. In practice a lapse is one of four things.
Nobody owns the renewal. The certificate was bought by a developer, an agency or a previous employee, and the renewal notice goes to an address nobody reads any more. The site works until the date passes.
The site moved and the certificate did not. A new host, a rebuilt server, a fresh account, and the certificate stayed with the old one.
The domain points somewhere else. Automatic certificates are issued and renewed for the domains pointed at the hosting. Move the nameservers and either nothing is issued on the new account or the certificate being served is not the one for that name. A visitor cannot tell that apart from an expiry, because the warning is identical. Our guide to how to point your domain at your hosting covers the record side.
A name was added and nothing was issued for it. A new subdomain, a renamed domain, a second domain on the same account. One certificate covers one hostname, or the subdomains of one domain when it is a wildcard. A name nobody bought a certificate for warns from its first visit.
The free certificate and the paid one expire differently
The AutoSSL certificate included with every shared hosting plan is issued and renewed automatically for the domains pointed at the hosting. There is no term to diarise and no order to pay, so a lapse here almost always means the domain is not pointing where you think it is. If you are unsure whether the free certificate covers your case, whether you need a paid certificate at all takes that question apart.
A paid certificate is a term of one, two or three years, available on every tier. We generate a renewal order when the certificate nears the end of its validity, and once that order is paid the new certificate is configured, validated and provisioned. That covers the administration. It does not cover the weeks after the date passes while the order sits unpaid, and it assumes the domain is hosted here.
Lead time is what people underestimate:
| Certificate | Issued in | If it lapses today |
|---|---|---|
| Domain validated | Minutes | Replaceable the same hour |
| Organisation validated | 1 to 3 days | Days of warning pages, plus a records check that stalls on any mismatch |
| Extended validation | 1 to 5 days | The longest of the four, with the same records check |
| Wildcard, domain validated | Minutes | Replaceable the same hour, once you know every subdomain it must cover |
Warranty figures sit behind each tier, are the certificate authority's own, and are stated in US dollars. They cover a fault in the certificate itself, not the trade you lose while the site warns.
A valid certificate can still produce the warning
This is the case that wastes money, because the certificate is current and renewing it changes nothing.
A certificate is issued for a specific hostname. If it was issued for www.yourbusiness.com.au and people reach the site at yourbusiness.com.au, or the reverse, the browser sees a name that does not match and warns exactly as it would for an expiry. The same happens when a domain is renamed, when a staging copy is served on the live address, or when an old domain's certificate is still installed. The tell is the name on the certificate, not the date.
How to confirm what is installed
Open the site in a private window and read the certificate through the browser's page information panel, which shows the issuer, the hostname it was issued for, and the validity dates. Do it twice, with www and without, because that is where a mismatch hides.
If the certificate is one of ours, ask us which certificate is on the domain and when it lapses. Phone 1300 565 610, 9am to 5pm Monday to Friday, or email hello@webhostingpeople.com.au, which is answered 24/7.
How to fix it, in order
- Confirm where the domain points. If the nameservers moved, fix that first, because a new certificate will not help while the wrong server answers.
- Decide what you are buying. Domain validated covers encryption. Organisation validated is for when a customer, tender or platform asks you to prove the business exists. Extended validation is for when a payment provider or procurement process specifies it. DV, OV and EV compared sets out the difference.
- Order or renew, then mind the lead time shown in the table above.
- Check the result in a private window, on every hostname the site answers to, not only the one you typed.
- Look for anything still loading over HTTP. An image, font or script pulled from an insecure address keeps the warning alive after the certificate is fixed, and the browser console lists them by name.
How to stop it happening again
- Write down who holds the certificate. If a developer or agency bought it, find out which account it sits on and get it into an account the business controls.
- Put the date in a calendar, 30 days before it lapses, or 45 for organisation and extended validation, because the records check can stall.
- Keep the contact address on the order current. The renewal notice is the only warning you get, and it goes there.
- List every hostname in use, and do not call a rebuild or a host move finished until the certificate is confirmed on the new account.
Frequently asked questions
Does an expired certificate mean my site has been hacked? No. It means the certificate is out of date, or the one being served is not valid for the address. A hack is a separate question, and the warning is not evidence of one.
Will visitors see the warning on every page? Yes, on every page served from that hostname, until a valid certificate is installed. It is not limited to the page that takes payments.
Can a visitor click through and use the site? They can, through a link the browser does not make prominent. Most do not, and the ones who do are being told your site may be impersonated.
Does an expired certificate affect my email? No. The certificate covers the web connection on that hostname. Mail delivery is handled by the mail records on the domain, which are separate.
I renewed it and the warning is still there. Why? Three usual reasons: the certificate has been ordered but not yet issued, the browser is showing a cached page, or what is installed is for a different hostname than the one being visited. Check the certificate details rather than the date.
Get HTTPS back in order
If the certificate is included with your hosting, check where the domain points first, because the automatic renewal follows the domain and not the account. If you need a paid certificate, the tiers, the terms and the current price for each one are on the certificate page, along with the lead time for each tier.
If you are not sure what is installed, tell us the address and we will tell you which certificate is on the domain and when it lapses. Phone 1300 565 610 between 9am and 5pm Monday to Friday, or email hello@webhostingpeople.com.au, which is answered 24/7.
Primary action: Compare the certificate tiers