Fix this week

Your site's security certificate runs out in 12 days

What it means

The security certificate (SSL or TLS certificate) that gives your site its padlock has an end date. EverThread read that date from your live site and saw that it is 30 days away or closer. After that date, browsers show visitors a full-page warning instead of your site.

This alert is not always a sign of trouble. Many automatic renewal systems wait until the last few weeks before they renew, so a healthy certificate can sit inside the 30-day window for a short time. What matters is whether the date moves. If it stays the same while the days count down, renewal is not happening.

Certificates are also getting shorter. Since March 2026, new public certificates can be valid for at most 200 days, and that limit drops to 100 days in 2027 and 47 days in 2029. Renewing by hand once a year is no longer possible, so automatic renewal matters more every year.

Why it matters

This is the easy moment to deal with it. If the certificate expires, every visitor sees "Your connection is not private" or a similar warning, and most will leave. Forms, checkouts and logins stop working for them too.

Renewing early costs nothing and changes nothing a visitor can see. Waiting is risky, because a DNS problem or an expired payment card found on the last day turns a routine task into an outage.

How to check your own site

1. Click the padlock or site information icon to the left of your address, open the certificate details, and find the "Valid to" or "Expires on" date. The wording differs between browsers.
2. Note the name under "Issued by". A free certificate authority such as Let's Encrypt usually means your host or server renews it automatically. A certificate you paid for usually has to be renewed and installed by hand.
3. Check again in a few days. If the date has moved forward, automatic renewal worked and there is nothing more to do. If it has not moved and there are fewer than about three weeks left, act now.

How to fix it

Any website

1. Ask your hosting company: "The SSL certificate on example.com expires on [date]. Can you confirm it will renew automatically, or renew it now?" Most hosts include free certificates and renew them for you.
2. If you bought a certificate from a seller, renew it with them, then install the new certificate where your site is hosted. The job is not finished until the new certificate is live.
3. Update the contact email and payment card on every account involved, including your domain registrar and hosting account, so a failed payment or a bounced email does not stall the renewal.

WordPress

1. Certificates are handled by your host, not by WordPress. Look in your host's dashboard for an SSL or HTTPS section that shows the expiry date and whether automatic renewal is on.
2. If it is off, turn it on. If you cannot find the setting, ask your host to confirm it is enabled.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms renew certificates for you. If yours is close to its end date, it usually means the platform cannot confirm your domain still points to it.
2. Open the domain settings in your site dashboard and look for connection or SSL warnings. Compare the DNS records at your registrar with the ones the platform lists, and fix any that differ.
3. If the warning does not clear within a day, contact the platform's support before the end date.

cPanel hosting

1. Open "SSL/TLS Status" to see each domain and its expiry date. If a domain shows an AutoSSL error, the message often says the domain points to a different server. Fix the cause, then click "Run AutoSSL".
2. If AutoSSL is not available, ask your host to enable it. For a paid certificate, install the renewed one under "SSL/TLS", then "Manage SSL sites".

Cloudflare

1. With the orange cloud (proxy) on, visitors see a certificate that Cloudflare renews by itself. Check SSL/TLS, Edge Certificates to confirm it is Active.
2. If this alert is about a custom certificate you uploaded to Cloudflare, upload the renewed certificate before the end date. Cloudflare does not renew uploaded certificates.
3. If the record is set to "DNS only" (grey cloud), visitors see the certificate on your server, so renew it there. Keep it current even with the proxy on, or Cloudflare in "Full (strict)" mode shows visitors a 526 error.

Apache or Nginx

1. Run sudo certbot certificates to see each certificate, its domains and its expiry date.
2. Test renewal with sudo certbot renew --dry-run. If it fails, fix the error it reports, then run sudo certbot renew.
3. Confirm the automatic timer is scheduled with systemctl list-timers | grep certbot.
4. Make sure the web server reloads after each renewal, or it keeps serving the old certificate from memory. The Certbot Apache and Nginx plugins handle this. Otherwise, add a deploy hook like the one below.

sudo certbot renew --dry-run

# Reload Nginx after every successful renewal
echo '#!/bin/sh
systemctl reload nginx' | sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

What to send your developer

The certificate on port 443 has a notAfter date 30 days or less away. Find out which system issued it and whether that system's renewal job runs: a Certbot timer, cPanel AutoSSL, the host, or a CDN. Renewal usually fails because of a DNS change, a CAA record, HTTP-01 validation blocked on port 80, or a process that never reloads. With lifetimes shrinking, schedule renewal when about a third of the lifetime remains rather than at a fixed number of days, or use ACME Renewal Information (ARI) if your client supports it. Check the live date with the command below.

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate

Common questions