01The first ten minutes: confirm what is actually wrong
Not every browser warning means an expired certificate. Chrome's help page says a Your connection is not private error can come from the site, the network or the visitor's own device, so confirm it is your site before you change anything. Open the site in a private window on your phone over mobile data and again on a computer, click the warning or the lock, and read the certificate's validity dates. Then repeat the check on the address with www, the address without it and any subdomain you use, such as a booking or shop address. A certificate often covers one and misses another. Write down the exact message, because expired, wrong name and not trusted are three different repairs.
- Private window, phone on mobile data, then a computer
- Read the validity dates in the certificate details
- Check the www address, the bare address and every subdomain
- Note the exact error: expired, wrong name and not trusted need different fixes
02Renew it where it lives
A certificate is issued and renewed in one of a few places, and you need to know which. If your host manages it, open the control panel or a support ticket and ask for a renewal. If a CDN or proxy sits in front of your site, it may hold its own certificate, separate from the one on your server, so check both. If you bought one from a certificate authority, renew it with the issuer, install the new files and reload the server. Let's Encrypt certificates are valid for 90 days today, and it recommends renewing around day 60. It has announced that the default will move to 64 days on 10 February 2027 and to 45 days on 16 February 2028. A renewal job that quietly stopped can leave you expired within 90 days of the last good one, and the window shrinks as those dates arrive. After installing, test again in a private window, on both addresses.
- Host-managed: renew from the control panel or ask support
- Behind a CDN or proxy: check its certificate and the one on your server
- Bought from an authority: renew with the issuer, install, reload the server
- Test again in a private window on both addresses
03Why it keeps happening, and how to stop it
Certificates are getting shorter, not longer. CA/Browser Forum ballot SC-081v3, dated April 2025, cuts the maximum validity of public TLS certificates in steps: 398 days until 15 March 2026, 200 days since 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029. The maximum is already 200 days now. A yearly calendar reminder will not survive that. What does survive is automatic renewal switched on, expiry warnings sent to an address a person actually reads rather than a developer who left, and a written note of who owns the hosting account, the domain and the certificate. Check the domain registration date as well. It is a separate expiry, and it takes a site down just as completely.
- Automatic renewal switched on and tested, not assumed
- Expiry warnings go to an inbox a person reads
- A written note of who owns the hosting account, the domain and the certificate
- The domain registration date checked too: a separate expiry
04Where PROOF48 is the wrong choice
If an expired certificate is the only problem on a site you are happy with, a rebuild is the wrong fix. Renew the certificate and set up a renewal that does not depend on memory. We publish no emergency certificate repair and no price for one. A rebuild makes sense when the expiry is a symptom: nobody can log in to the hosting, the site is old, and the person who set it up is gone. Our 48-hour website is up to about five pages for 500 to 2,500 EUR, with hosting and SSL handled, paid after the preview. The Lite maintenance plan, at 27 EUR a month, lists managed hosting and SSL plus uptime monitoring with email alerts, and Plus and VIP include everything in Lite. They do not say certificate dates are watched separately, so ask before you assume. A store is 2,500 to 4,500 EUR, and larger or custom projects may need a deposit, as our terms say.
- Only the certificate expired on a site you like: renew it, do not rebuild
- No emergency certificate repair and no price for one from us
- Nobody can log in to the hosting and the site is old: a rebuild may be the fix
- Maintenance plans from 27 EUR a month: ask whether certificate dates are watched
An ordering site and a browser warning
Rotiseria Baba Novac is a rotisserie in Bucharest that left the delivery aggregators for its own ordering system at rotiseria.ro: menu, cart, Stripe checkout, pickup slots and confirmation emails. The case study does not record how its certificate is handled, so we make no claim about it. It does show where an expired certificate would be hardest to ignore: a site that takes orders, where a browser warning stands between a customer and the checkout. We have no figure for orders lost to a warning, and we will not invent one.
See the build: Rotiseria Baba NovacQuestions, answered
How long does it take to fix an expired certificate?
It depends on where the certificate lives. If your host manages it, it can be a support ticket. We have no average time to quote.
Is it safe to click through the warning on my own site?
Once, to look, on a network you trust. Do not log in or enter personal details on a page with a certificate error, and do not ask customers to do it.
Will an expired certificate hurt my Google ranking?
Nobody controls a Google position and we promise none either way. Fix the certificate first, because visitors meet the warning before anything else.
Does a PROOF48 website include SSL?
Our 48-hour website page lists hosting and SSL as handled. The Lite maintenance plan lists managed hosting and SSL, and Plus and VIP include everything in Lite.
Where PROOF48 fits
When a certificate expires, confirm the error, find where the certificate lives, renew it there, install it and test both addresses in a private window. Then switch on automatic renewal and send expiry warnings to a person. If the only problem is the certificate, do not rebuild. PROOF48's 48-hour website lists hosting and SSL as handled.
Cosmin Tiu · Founder, PROOF48
Cosmin has worked in online marketing and software development since 2018, and has built with AI every day since January 2023. He still writes code from scratch daily, in Python, React, Rust and C#. PROOF48 ships business websites in 48 hours and invoices afterwards, so every opinion on this blog was paid for in real builds, not in theory.