A certificate expires on a date. Your website goes down on that date.

Automatic renewal is not the same as guaranteed renewal

Most certificates now renew themselves, which is why most people have stopped thinking about them. The trouble is that automatic renewal has a lot of moving parts, and every one of them fails quietly: a validation check that can no longer reach your server, a DNS change that broke the check, a hosting migration where the renewal job did not come along, an expired card on a paid certificate.

None of that produces an alert you will see. The certificate simply carries on working until the day it does not, and then every visitor gets a full-page browser warning telling them your site may be dangerous.

What a browser warning actually costs

It is not a small cosmetic problem. Modern browsers do not show a subtle padlock change, they interrupt the visit with a red full-screen warning that most people will not click past, and should not. Traffic goes to nearly nothing for the duration.

Search follows. Google has treated HTTPS as a signal for years, and beyond the ranking effect, a site that cannot be crawled securely stops being crawled properly at all. A certificate outage over a weekend is a traffic outage over a weekend, plus however long recovery takes.

Don't know what these are? Don't worry, we've got you!

Your domain and your www are not the same thing

This surprises people, and it is why we count expiry separately for the apex domain and the www version. They can genuinely differ, and when they do the failure is invisible to the owner, because whichever one they type is the one that works.

We have seen a live trading business whose apex domain had broken HTTPS for months while www worked perfectly. The owner had no idea. Anyone who typed the address without the www got a security warning and left.

The obsolete encryption nobody turns off

TLS 1.0 and 1.1 are long obsolete and have known weaknesses, but plenty of servers still accept them because nobody ever explicitly turned them off. It is the kind of default that sits there for years.

We check whether your server still accepts them, because leaving them on undermines the point of having a certificate at all, and because it is a one-line configuration change for whoever runs your hosting.

Common questions

1. My certificate renews automatically. Do I still need to watch it?

   Yes, because automatic renewal is a process that can break, and it breaks silently. Watching the expiry date is how you find out that the automation stopped working while you still have weeks to fix it rather than hours.

2. How much warning do I get before a certificate expires?

   From the certificate itself, usually none that reaches you. Renewal notices go to whichever address was used at setup, which is frequently a developer who has moved on. Counting down the actual expiry date on the live site is more reliable than trusting the reminder.

3. What is HSTS?

   A header that tells browsers to refuse the insecure version of your site in future, so a visitor cannot be silently downgraded to an unencrypted connection. It is a small addition once HTTPS is working properly.

Fixed once is not fixed

Everything on this page is a one-off job for whoever manages your website or your DNS. The reason it is a product rather than an afternoon is that all of it drifts: records get dropped in a migration, renewals break, a new tool starts sending email on your behalf and nobody updates the list. We check every week and show you what changed, in plain English, with the fix attached.

The other checks