SSL certificate expired? Why the padlock is gone

When it breaks 6 min read

Why the padlock disappears from your website, what your customers see instead of your pages, and what has to happen before the warning goes away.

Somebody called and said your website is giving them a warning. You looked, and beside the web address there is now the words Not secure, or a full red page telling them to go back. Nothing about your business has changed. Your pages are exactly as you left them.

This is one of the easier faults to fix and one of the worst to leave, because of what the visitor sees before they ever reach your work.

What the padlock actually means

The padlock says one narrow thing: the connection between the visitor's phone and your website is scrambled, so whatever passes along it cannot be read by anyone in between. That matters most for a contact form, where somebody types their name, their number and their address.

What it does not mean is that you have been checked out, that your business is legitimate, or that your website is any good. It is a lock on a door.

Browsers draw it differently now. Chrome and Edge stopped showing a padlock in September 2023 and put a small sliders icon in its place. Safari and Firefox still show a lock. What they are telling you is the same in all of them.

The certificate is the small file that proves your site is entitled to that lock. Every certificate carries a start date and an end date. Past the end date, browsers stop accepting it, and they say so loudly.

What your customer sees instead of your site

Modern browsers do not show a discreet note. On an expired certificate, most of them replace your page entirely with a full-screen warning, often red, using words like attackers and private information.

There is usually a way past it, buried behind an Advanced link, but a homeowner looking for a roofer will not take it. They will go back to the results and tap the next name. They will not conclude that a certificate expired. They will conclude something is wrong with you.

So the practical damage is that the warning stands where your phone number used to be.

Why certificates expire on purpose

Certificates are deliberately short-lived. Rather than being issued once for years, the ones most small sites use are issued for a matter of weeks and renewed automatically, over and over, by the server.

That short life is a safety feature. A certificate that leaked would be useless quickly. The side effect is that your site depends on a small automatic job succeeding every few weeks, forever, and nobody gets an alert when it silently stops succeeding.

Nothing you did made this happen. A renewal job that had run without complaint for two years failed one Tuesday, and there was nowhere for it to tell you.

The four reasons the automatic renewal stops

There are four common causes, and every one of them is plumbing rather than anything you did.

The renewal was never automatic. Some certificates are bought by the year and renewed by hand. If the person who bought it has moved on, nobody is renewing it.

The site moved and the job did not. Change hosting, and the automatic renewal on the old server keeps running for a site that no longer lives there.

The domain settings changed. The renewal has to prove you still control the name. If the name now points somewhere else, the proof fails and the renewal stops.

The certificate covers the wrong version of your address. A certificate issued for the www version does not cover the plain version, or the other way round. The site works on one and warns on the other, which is why one person sees a problem and another does not.

How to read the expiry date yourself

You do not need a tool for this. On a desktop browser, click whatever sits immediately to the left of the web address: a padlock in Safari and Firefox, a small sliders icon in Chrome and Edge, or the words Not secure. Then look for the connection or certificate details. The certificate shows who issued it, which addresses it covers, and the exact date it stops being valid.

Two things are worth reading there. First, the end date, which tells you whether it has expired or is about to. Second, the list of names it covers, which tells you whether your www and non-www addresses are both included.

That is enough information to hand over. Whoever fixes it does not have to start with a diagnosis.

Getting it fixed, and by whom

This belongs to whoever runs your hosting. It is their server, their renewal job, and on most modern hosting a certificate is included rather than sold separately.

Call them and say: the certificate on my domain expired on this date, the site is showing a security warning, please reissue it and confirm the automatic renewal is running for both the www and non-www versions. That last clause saves the second phone call.

If somebody quotes you for a certificate before checking whether your host already provides one, ask that question first. On a lot of hosting it is included, and there is no reason to pay for something you already have.

A short checklist

• Load your site on a phone and on a computer and note the exact warning
• Click the icon beside the web address, or the Not secure text, and read the expiry date
• Check the certificate lists both your www and non-www addresses
• Try both versions of the address to see whether only one warns
• Call your hosting company with the date and the wording, not just a description
• Ask whether a certificate is included in your plan before buying one
• Ask them to confirm the automatic renewal is running afterwards
• Load the site yourself the following morning and check the warning has gone

Questions people ask

Why does my website say Not secure

Either the security certificate has expired or the site is still being served over the old unencrypted connection. Clicking the words in the address bar and reading the certificate details tells you which.

Will an expired certificate stop people buying or inquiring

It stops many of them reaching the page at all, because the browser puts a full-screen warning in front of it. The form may work perfectly behind a wall nobody walks through.

How much does a certificate cost

On most modern hosting it is included in what you already pay, so ask your host before you buy anything. Certificates can be bought separately, but check first.

How long does it take to fix

Reissuing is usually quick once somebody with access starts. The delay is almost always finding out who has that access.

The padlock is missing but there is no warning, what is that

Check which browser you are in first. Chrome and Edge stopped drawing a padlock in September 2023, so on those there is nothing missing. Then read the address itself: if it starts http rather than https, the page is being served over the old unencrypted connection and nothing is sending visitors to the secure version, which is a redirect your host can switch on. A stray insecure image or script no longer causes this quietly. Browsers now upgrade images, audio and video to the secure address and block everything else outright, so that fault shows up as a missing photograph or a feature that stopped working.

Can I ignore it if I do not take payments online

No. The warning appears on every page, including the one with your phone number on it, whether or not anything is being paid for.