Website SSL Certificate: The Padlock That Quietly Expires

Your website has a little padlock. Nobody looks at it, nobody thanks it, and it works until the day it doesn’t. Then every visitor gets a full-screen warning that your site might be dangerous, which is a rough way to find out about a renewal date.

I see this one a lot. A site runs fine for a year or two, the certificate quietly expires, and the owner hears about it from a customer who “tried to look you up but it said scary stuff.”

The short version

• An SSL certificate is what puts the padlock and the https in front of your web address. It has an expiration date, like milk.
• Most good hosts renew it automatically, but “most” and “automatically” both have fine print.
• Check it yourself once a quarter. It takes about 30 seconds and a browser.

What is an SSL certificate, in plain English?

An SSL certificate is a small file that proves your website is really yours and scrambles the data moving between your site and a visitor. That’s the padlock. It’s why a contact form isn’t shouting someone’s phone number across the internet in plain text.

(Technically it’s called TLS now, and SSL is the old name. Everyone still says SSL, so I’m not going to fight it. I have bigger battles, like the 2019 copyright footer.)

Why does an SSL certificate expire?

Certificates expire on purpose, so a certificate for a site that no longer exists, or no longer belongs to the same owner, can’t keep vouching for it forever. Many free certificates only last a few months, and they depend on a renewal running in the background.

That background renewal is the weak spot. It can fail quietly if your hosting changed, your DNS got moved, a plugin got swapped, or the person who set it up left and took the knowledge with them. Nothing breaks on the day it fails. It breaks on the day the old certificate runs out, usually on a weekend, because of course it does.

Here’s the pattern that bites people. The site gets built, the padlock shows up, everyone high-fives and moves on. Two years later the hosting company changes something, the renewal job stops, and nobody remembers there was ever a renewal job. The padlock wasn’t a one-time purchase. It’s a subscription nobody told you about, and it bills in embarrassment.

What happens to my website when the certificate expires?

Visitors see a browser warning page instead of your website, and most of them leave. They won’t squint at the fine print and click “advanced” to proceed. They’ll assume you got hacked, or they’ll just call the next business on the list.

Google isn’t thrilled either. A site that throws certificate errors is a bad experience, and it can drag your visibility down while it stays broken. Worse, anything that depends on your site, like online booking links or forms, can stop working too. Quietly. Without a single email telling you.

How do I check my SSL certificate?

Open your site in a browser and click the padlock (or the small icon) next to the address. There’s an option to view the certificate, and it shows the date it expires. If that date is within a month, ask your host or web person to confirm the renewal is set up.

A few other quick checks while you’re at it:

• Type your address with and without “www” and make sure both load clean, no warning.
• Type the plain http version and confirm it jumps over to https on its own.
• Look at an old page or two for images that still load from http. That’s the “mixed content” nag, and it’s a damn annoying one.

Put a quarterly reminder on your calendar. Same day you check your backups, if you’re the organized type. (I’m not always the organized type, so I set the reminder and let it be organized for me.)

Who is supposed to renew it?

Whoever controls your hosting and domain, which is exactly why you want to know who that is. If you’ve never had the “who actually owns my domain” conversation, start there, because a certificate you can’t get to is a certificate you can’t fix at 9 PM on a Sunday.

If you’re in my neck of the woods, I also handle hosting, security, DNS and SSL help in Palm Coast and the surrounding area, mostly so nobody has to learn what a certificate chain is the hard way.

Questions people ask

Do I have to pay for an SSL certificate?

Not usually. Plenty of hosts include a free one, and that’s fine for most small business sites. Paid certificates exist, but the padlock looks identical to your visitors.

Does SSL make my site hack-proof?

No. It protects the connection, not the site itself. You still need updates, decent passwords and backups. The padlock is a seatbelt, not a force field.

My site says “Not secure” but I have SSL. Why?

Usually something on the page is still loading over plain http, like an old image or script, or the certificate doesn’t cover the exact address being visited. Both are fixable, and it’s a quick job for whoever manages your site.

Don’t let the padlock be a surprise

Nobody has ever been excited about renewing a certificate, which is exactly why it gets forgotten. If you want someone to check yours, set up the reminders and keep an eye on it, tell me about your site on the start a project page and I’ll take a look.