# What happens when a website certificate expires?

URL: https://ergostrat.com/en/monitoring/ssl-certificate-expired.html
Language: [Български](https://ergostrat.com/monitoring/ssl-certificate-expired.html) · [English](https://ergostrat.com/en/monitoring/ssl-certificate-expired.html) · [Français](https://ergostrat.com/fr/monitoring/ssl-certificate-expired.html) · [Deutsch](https://ergostrat.com/de/monitoring/ssl-certificate-expired.html)

A browser may interrupt access with an invalid-certificate warning, while other clients may refuse the connection. Check the actual expiry, the certificate being served and the settings. This does not automatically establish a breach or a particular loss in Google.

## What does the visitor see?

The message depends on browser, version and language. Firefox documents SEC_ERROR_EXPIRED_CERTIFICATE for an expired certificate and recommends checking the device clock. An incorrect date can also cause validation problems.

Establish the exact error and the certificate served at the affected address. Do not rely on a uniform padlock symbol across browsers. Do not ask customers to bypass the warning; address the cause of the invalid connection.

## What does this mean for HTTPS?

The certificate helps validate the server’s identity. Expiry is a validity problem, not proof that interception has already occurred. The warning alone does not establish an attack.

Some clients refuse connections without a page offering continuation. For an API, this may appear as an automation error. Check affected addresses and services against the certificates they use rather than assume only the homepage is involved.

## What can be said about Google?

Google announced HTTPS as a ranking signal in 2014. That historical announcement does not establish a fixed penalty, immediate decline or loss amount for every expired certificate.

Restore access and check actual crawl and traffic data. A browser warning affects visitors, but does not by itself quantify a change in rankings or revenue.

## How are maximum lifetimes changing?

The CA/Browser Forum requirements concern publicly trusted TLS server certificates. “SSL certificate” is a common name. The maximum depends on issuance date:

- Before 15 March 2026: 398 days.
- From 15 March 2026 until before 15 March 2027: 200 days.
- From 15 March 2027 until before 15 March 2029: 100 days.
- From 15 March 2029: 47 days.

This does not retrospectively shorten a certificate already issued or mean every new certificate receives the maximum. From 15 March 2029, reuse of domain or IP validation is limited to 10 days; that is a different period from certificate validity.

Do not automatically apply the schedule to private internal infrastructure or other certificate types. An annual supplier contract does not establish a year-long individual certificate either. Track the actual expiry date.

## What is the practical impact?

A warning or refused connection may interrupt an enquiry, payment or data exchange. Consequences depend on functions and timing, not a general rule guaranteeing lost sales.

Let’s Encrypt recommends automated renewal before expiry. Check issuance, installation and the certificate actually served. An automated job may fail; define an owner and alert rather than rely on a calendar reminder alone.

## Questions

### Is there a grace period?

A commercial renewal window does not extend the certificate’s validity. Client behaviour depends on its validation and policy. Check the exact expiry and error rather than assume extra days of access.

### Can internal tools be affected?

Portals, APIs and other clients using the expired certificate may be affected and show different errors. Public-certificate rules do not automatically set the lifetime of a private internal PKI.

### Is automatic renewal enough?

Not merely as an enabled setting. Check successful domain validation, available access and the certificate the service actually uses. The domain and automation itself need assigned owners too.

## Sources

- [Mozilla — warning codes and expired certificates.](https://support.mozilla.org/en-US/kb/what-does-your-connection-is-not-secure-mean)
- [Google — the historical HTTPS ranking announcement.](https://developers.google.com/search/blog/2014/08/https-as-ranking-signal)
- [CA/Browser Forum — current requirements and lifetimes.](https://cabforum.org/working-groups/server/baseline-requirements/requirements/)
- [Let’s Encrypt — integration and automated renewal.](https://letsencrypt.org/docs/integration-guide/)

## Related reading

- [What does website uptime monitoring mean?](https://ergostrat.com/en/monitoring/uptime-monitoring.html)
- [How often should a website be checked?](https://ergostrat.com/en/monitoring/check-frequency.html)
- [Our contact form is not sending emails: what should we check?](https://ergostrat.com/en/monitoring/contact-form-not-sending.html)

## Track expiry and the renewal owner.

Our monitoring checks certificate and domain expiry as part of the hourly check under the written inventory. This does not guarantee a certificate will never expire or automatically include every renewal or replacement task. Necessary work is defined in the agreed scope.

[Ask about monitoring](mailto:contact@ergostrat.com?subject=Website%20certificate%20and%20monitoring%20question)