Fix today

Your site is showing visitors a security warning

What it means

A security certificate (often called an SSL or TLS certificate) is a small file on your web server. It proves your site is really yours and lets browsers set up an encrypted connection. Every certificate has an end date, and after that date browsers stop trusting it.

EverThread connected to your site and read the end date on the certificate your server sent. That date has passed. Your site has not been hacked. The certificate simply was not renewed in time.

Usually automatic renewal was never set up, or it quietly broke after a move to a new host or a change to your domain settings.

Why it matters

Visitors do not see your site at all. Chrome shows "Your connection is not private" with the code NET::ERR_CERT_DATE_INVALID, Firefox shows "Warning: Potential Security Risk Ahead", and Safari shows "This Connection Is Not Private". Most people will not click past it, and they rarely tell you why they left.

Forms, checkouts and logins stop working too. Services that connect to your site behind the scenes, such as payment notifications or booking tools, usually refuse the connection outright.

How to check your own site

1. Open your site in a private or incognito window. If you see a full-page warning, click "Advanced" or the details link. It should mention an expired certificate or an invalid date.
2. A wrong date on your own computer can cause the same warning. EverThread checks from its own servers, though, so if we reported it, the certificate itself has expired.
3. Check both versions of your address, with and without www. They can have separate certificates.

How to fix it

Any website

1. Contact your host and say: "The SSL certificate on example.com has expired. Please renew it and turn on automatic renewal." Most hosts include free certificates and can issue a new one quickly.
2. If you bought the certificate from a seller, renew it with them, then install the new certificate on your host. Paying for the renewal is not enough on its own.
3. When it is fixed, reload your site in a private window and confirm the padlock is back.

WordPress

1. WordPress itself does not manage certificates. Your hosting company does, so follow the steps for your host: the cPanel steps below, or your host's own dashboard.
2. Many managed WordPress hosts have a button to reissue the certificate, usually under SSL, Security or Domains. Afterward, clear any caching plugin and check the site in a private window.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms issue and renew certificates for you. When renewal fails, it is almost always because your domain no longer points to the platform correctly. Open the domain settings in your site dashboard and look for a warning about the connection or SSL status.
2. Compare the DNS records at your registrar with the ones the platform asks for, and fix any that differ. If the status has not changed within a day, contact the platform's support.

cPanel hosting

1. Log in to cPanel and open "SSL/TLS Status". It lists each domain and whether its certificate is valid.
2. Select the affected domains and click "Run AutoSSL". AutoSSL issues free certificates and renews them automatically. If you do not see the button, your host may have AutoSSL turned off. Ask them to enable it.
3. If AutoSSL reports an error, the message usually says why, often that the domain points to a different server. Fix that, then run it again.
4. If you use a certificate you bought elsewhere, open "SSL/TLS", then "Manage SSL sites". Paste in the new certificate, your private key, and the "Certificate Authority Bundle" your seller provided, then click Install.

Cloudflare

1. With the orange cloud (proxy) on, visitors see a certificate Cloudflare renews on its own. An expired certificate usually means the record is set to "DNS only" (grey cloud), so visitors see your server's certificate. Renew it using the other steps on this page.
2. Under SSL/TLS, Edge Certificates, the Universal certificate should show as Active. If you uploaded your own custom certificate there, Cloudflare does not renew it. Upload a new one, or delete it so the free Universal certificate takes over.
3. A Cloudflare error page numbered 526 means the certificate on your own server is not valid, often because it expired. Renew it on the server.

Apache or Nginx

1. If you use Let's Encrypt with Certbot, run sudo certbot certificates to list each certificate and its expiry date.
2. Run sudo certbot renew. If it fails, the error usually names the cause: port 80 blocked by a firewall, the domain pointing to a different server, or a server rule that blocks the /.well-known/acme-challenge/ folder.
3. Reload the web server so it uses the new files. The Certbot Apache and Nginx plugins do this for you. Otherwise, run the reload command below.
4. Check that automatic renewal is scheduled with systemctl list-timers | grep certbot. Most Certbot installs set up a timer. Test it with sudo certbot renew --dry-run.

sudo certbot renew
sudo systemctl reload nginx     # or: sudo systemctl reload apache2

What to send your developer

The certificate served on port 443 has a notAfter date in the past. Renew it, deploy the full chain, and reload every process that terminates TLS: the web server, any load balancer, and any CDN or proxy holding a custom certificate. Then fix why renewal failed: a stopped timer, a changed DNS record, a CAA record that no longer allows your certificate authority, or blocked validation. Confirm the live dates from any machine with the command below.

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer

Common questions