What Happens When an SSL Certificate Expires?

1. Browsers show a full-page warning

Chrome shows NET::ERR_CERT_DATE_INVALID (“Your connection is not private”), Firefox and Safari show equivalents. There is no “continue quietly” path for normal users — and research consistently shows the large majority abandon the page immediately. Your site is effectively down for humans even though the server is healthy.

2. APIs, webhooks & apps hard-fail

Machine clients don't get a click-through button. Payment callbacks, shipping webhooks, mobile apps, IoT devices, and cron integrations fail the TLS handshake and start erroring or queueing retries. This is usually where the real money burns: silent order failures and sync backlogs that persist after the certificate is fixed.

3. Search rankings slide

HTTPS is a confirmed ranking signal, and expiry removes it. Combined with spiking bounce rates and reduced crawling, pages can lose positions within days. Note the asymmetry: recovery requires both renewal and winning back crawl trust, which takes longer than the outage itself. Prevention is dramatically cheaper — see how to check expiry in seconds.

4. Trust damage outlasts the outage

Users who saw a security warning remember it. Partners ask uncomfortable questions. If the expired host served a login, checkout, or signup flow, expect a measurable conversion dip for days after recovery — especially painful as certificate lifetimes shrink toward 47 days and renewals happen eight times a year.

Recovery checklist (in order)

• Confirm the failure mode first: expiry, hostname mismatch, and broken chain look identical to users. Run the domain through a checker before touching anything.
• Renew and deploy everywhere: every IP and CDN edge behind the hostname must serve the new cert — one stale origin re-triggers the incident.
• Verify externally: check from outside your network (DNS caches and office proxies lie). Confirm the new notAfter date is live.
• Close the loop: put the host on monitored alerts at 60/30/14/7/1 days so the next renewal can't fail silently.