In this guide
Few website problems are as visible as an expired certificate: browsers replace the page with a red warning and most people turn back. An expired domain is worse, taking the website and the email on it offline. Both are entirely preventable.
Key takeaways
- An expired HTTPS certificate makes browsers show a full-page warning, and most visitors leave.
- Free Let's Encrypt certificates last 90 days and renew automatically, until the renewal quietly fails.
- Domain names expire too; an expired domain takes the website and email offline.
- A daily check of both expiry dates, with a reminder weeks ahead, prevents both.
What happens when they expire
- Certificate: browsers show "Your connection is not private" and block the page until the visitor clicks through, which few do.
- Domain: the website and email stop working, and after the grace period someone else may register the name.
Why automatic renewal still fails
- A DNS or server change stops the certificate tool from proving it controls the domain.
- The site moved to a new host and the old renewal job keeps running on the old server.
- The card on file for the domain expired, or the renewal email went to a former employee.
- A CDN or proxy in front of the site serves its own certificate that nobody looks after.
Check both dates now
- Open the site and click the padlock in the address bar to see the certificate's expiry date.
- Look up the domain at your registrar (or a WHOIS lookup) for its expiry date.
- Note who renews each, and whether it is automatic.
Get reminded automatically
Studio's daily watch reads the certificate and, for most domain endings, the domain's expiry date, and warns you well before either runs out, together with downtime and indexing problems on the same site.
Checklist
- Find out who renews your certificate: the host, a CDN, or a tool like certbot.
- Check the current expiry date of the certificate and of the domain.
- Turn on auto-renew for the domain at the registrar, with a card that will not expire first.
- Make sure renewal emails go to an inbox someone reads.
- Monitor the site so you are reminded before either date.
Questions
Is a free certificate as safe as a paid one?
For encryption, yes: free certificates from Let's Encrypt use the same strength as paid ones. Paid certificates mainly add support and longer validity.
How long before expiry should I be warned?
At least two weeks for a certificate and a month for a domain, so there is time to fix a failed renewal or an expired card.