What happens when your website's security certificate expires?
Visitors usually get a full-page browser warning, such as "Your connection is not private", before your site loads, and some will leave rather than click past it, so inquiries from the site can drop that day. Your host or website builder usually renews certificates automatically, but renewals can fail. They are also getting more frequent: the industry body for certificates voted in 2025 to cut the longest allowed lifetime from 398 days to 47 days in steps ending March 2029.
What visitors see
Browsers check a site's security certificate before showing the page, and a lapsed one usually brings up a full-page warning instead. Google's Chrome Help page on common error messages groups "Your connection is not private" with its certificate errors and, after the steps a visitor can try, says that if the error stays, contact the website owner.
That page ties one date-related error, NET::ERR_CERT_DATE_INVALID, to the visitor's own device clock being wrong, so one customer's warning is not proof of a problem with your site. Check it yourself on a phone and on a computer, on different connections.
Why it costs you inquiries
A warning before the page loads can turn many visitors away, so form messages, taps on the phone number and clicks from ads can drop with it. Some customers will assume the site was hacked. The related answer on spotting a hacked website lists browser warnings among the signs; an expired certificate is often the simpler cause, and worth ruling out first.
Who renews it
Let's Encrypt, a nonprofit certificate authority, says it does not charge for its certificates, that its default certificates last 90 days, and that it recommends renewing them every 60 days. It notes that some hosting providers charge a small fee to provide them.
Many hosts and website builders renew certificates automatically. As general advice, ask yours three things: who renews it, whether renewal is automatic, and who gets the alert if it fails.
Why renewals are getting more frequent
In April 2025 the CA/Browser Forum, where certificate issuers and browser makers set the rules, adopted ballot SC-081v3, with Apple, Google, Microsoft and Mozilla among those voting yes. It sets the maximum lifetime of public website certificates to fall from 398 days to 47 days, in steps scheduled from March 2026 to March 2029. Renewing by hand every few weeks is easy to miss, so automatic renewal matters more each year.
If it happens
- Contact whoever hosts the site or runs the builder, and ask them to renew or reissue the certificate.
- If you renew it yourself, check the payment card and that the domain still points to the site.
- Once it is fixed, send a test inquiry through every form.
- Note the dates in your lead records, so a dip in inquiries that week makes sense later. The related answer on why a website is down covers other outages.
Sources
- Google Chrome Help, "Get help with common error messages in Chrome"
- Let's Encrypt, "FAQ"
- CA/Browser Forum, "Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods" (11 April 2025)
Related answers
- Does a small business website need HTTPS?
- Why is my website down, and what should I check first?
- How can you tell if your business website has been hacked, and what do you do first?
Websites, upgraded or built
Most businesses do not need a new website. They need the one they have to load fast, say clearly what they do and ask the visitor to take one step.