When does my SSL certificate expire?

What does that mean?

An SSL certificate, or more precisely a TLS certificate, proves two things to a browser: that the connection is encrypted, and that the server really is the one whose address is in the bar. For that it carries a list of names, a lifetime and the authority that issued it.

Once it expires, every browser shows a full-page warning before the website even appears. The site is then technically fine and practically gone: hardly anyone clicks through a warning like that, and forms or orders sit untouched.

How tight a remaining lifetime is depends on the issuer. Let's Encrypt and similar authorities issue for 90 days and renew on their own after about 60, so three weeks left is the normal state there. With a bought one-year certificate the same number is the moment to act. This tool takes that into account.

What can go wrong?

• The automatic renewal runs into nothing because the records have changed. It gets noticed on the day of expiry.
• The certificate covers the domain but not www. Anyone typing the address with www gets a warning.
• The host's own certificate is still on the server instead of the domain's. Then the name does not match, and the browser warns even though the encryption itself works.
• The server issued its certificate to itself. That happens automatically when a proper one was never set up. Browsers do not recognise it.

How do you fix it?

The certificate gets issued and renewed where the website sits, at almost every host with one switch in the control panel and usually at no extra cost. Which provider that is stands in the result above. What matters is taking in both names: the domain with and without www.

When issuing fails, it is rarely the certificate itself and usually the check before it. Which part exactly is answered by the question on why no certificate can be issued.