What the visitor actually sees
When a browser connects to a site over HTTPS, it checks the certificate presented by the server: was it issued by a recognised authority, does it match the domain name, and above all, is it still within its validity period? If the end date has passed, the check fails.
The result is a full-screen page, often red or grey, with a message such as “Your connection is not private” or “Warning: potential security risk ahead”. To continue, users must click deliberately discreet options such as “Advanced”, then explicitly accept the risk.
To an ordinary visitor, this message doesn't say “the certificate expired yesterday”: it says “this site may be dangerous”. Few people take the risk, and that is exactly the behaviour browsers are designed to encourage.
The concrete consequences of an expiry
The impact goes far beyond the home page. An expired certificate affects everything that goes through that domain over HTTPS:
- Online shop: carts are abandoned, payments fail, and trust is damaged even after the fix.
- APIs and mobile apps: most HTTP clients refuse the connection without offering any workaround. The app simply looks “down”.
- Service integrations: webhooks, synchronisations and partners calling your domain fail one after another.
- Emails and forms: the links to your site in your campaigns all lead to the warning.
- Brand image: a screenshot of the error spreads quickly and stays associated with your name.
Why certificates still expire in 2026
Certificates have a limited lifetime, and that lifetime tends to get shorter as industry rules evolve. Shorter lifetimes improve security, but multiply the number of renewals… and therefore the opportunities to forget one.
Automatic renewal has greatly improved the situation, but it doesn't remove the risk. It can fail silently for very ordinary reasons: a modified DNS record, a server migrated without its scheduled task, a firewall blocking validation, an expired account at the provider, or simply a forgotten subdomain that was never included in the automation.
In small teams, the certificate was often installed by someone who has since changed roles. Nobody knows the expiry date… until the day it passes.
How to stop a certificate expiring without warning
The most reliable method is to monitor the certificate from the outside, exactly as a browser would, and to receive an alert early enough to act calmly.
- List every domain and subdomain exposed over HTTPS, including old ones.
- Have each certificate monitored by a tool that is independent from your server, so that failed automatic renewals are detected too.
- Receive a first alert several days before expiry, for example 15 days, then reminders if nothing changes.
- Send the alert to several people and over several channels (email, SMS, push notification) so it doesn't get lost in a single mailbox.
- After each renewal, check that the new expiry date has actually been picked up.
What LOXUp does for your certificates
LOXUp, LOXBOX's monitoring service, regularly checks the SSL certificates of the domains you entrust to it and displays the number of days remaining before expiry. As the deadline approaches, for example 15 days before, it sends an alert by email, by SMS (via WinSMS in Tunisia) or by push notification to all the authorised contacts on your team.
Combined with HTTP, TCP and Ping availability monitoring, this alert lets you treat renewal as a planned task rather than an emergency discovered by your customers.
Key takeaways
An expired certificate turns a perfectly working site into a “dangerous” one in the eyes of browsers. Automatic renewal reduces the risk without eliminating it. The only real protection is external monitoring with alerts sent early enough, to the right people.
Going further: SSL monitoring · uptime monitoring · all features