Nothing chases customers off a site like a red “Your connection is not private” screen - and the cause is usually a small thing you can fix in fifteen minutes. An SSL certificate is a digital document telling the browser: this site is what it claims to be, and the connection to it is encrypted. Without a valid certificate the browser does not let people through quietly - it throws up a big warning that most customers will not click past. For a store that is a closed till; for a company site it is a “something is wrong here” signal sent to everyone who arrives.
How to work out what broke
The messages differ between browsers, but they boil down to three scenarios:
- “Certificate has expired” (NET::ERR_CERT_DATE_INVALID) - the certificate had an expiry date and it passed. The most common case: the automation that was supposed to renew it stopped working and nobody noticed
- “Certificate does not match the domain” (ERR_CERT_COMMON_NAME_INVALID) - the certificate exists but was issued for a different address, for example for
www.yourcompany.com, and the customer arrived withoutwww(or the other way round) - A padlock with a warning instead of a red screen - the certificate works, but the page loads some elements (images, scripts) over unencrypted
http://. That is mixed content - the classic souvenir of moving a site to SSL
Quick diagnosis without technicalities: open the site on a phone (over mobile data, not office Wi-Fi) and on a computer. If you see the same warning everywhere, the problem is on the server, not on your machine.
The certificate expired - the fix
Today practically every host offers free Let’s Encrypt certificates with automatic renewal every 90 days. If a certificate expired, that automation jammed. The order of actions:
- Hosting panel → SSL/Certificates section. Find your domain and click “renew” or “generate new” (Let’s Encrypt). In most panels that is one button and 2-3 minutes of waiting
- Find out why the automation did not fire. The most common reasons: the domain recently changed DNS settings, somebody switched servers, a paid certificate nobody was watching ran out, or the host requires manual confirmation once a year
- After renewing, wait a few minutes and check in a private browser window - a normal window can hold the old warning in cache
If there is no SSL option in the panel or the button ends in an error, write to your hosting support - it is their infrastructure. And if the site sits behind Cloudflare, check there too: the SSL mode should be set to “Full (strict)”, and Cloudflare’s edge certificate renews itself.
What helps: set a reminder or monitoring for certificate expiry. Free tools can email you 14 days before it expires - that is 2 minutes of setup that saves a day with a red screen. Clients on ongoing support have certificate validity checked by monitoring, so they read this piece out of curiosity rather than need.
The certificate exists but “does not match the domain”
That is a configuration problem, not an expiry one. The certificate has to cover every address variant people arrive on - with and without www. When generating Let’s Encrypt in the hosting panel, tick both variants (usually a checkbox for “include www”). On top of that the site should have one canonical redirect: everything landing on http:// or on the www variant ends up on the target https:// - then the customer never sees the wrong variant.
Mixed content - the padlock with a warning
The site has a valid certificate, but links to images or scripts over the old http:// remain in the code. The browser encrypts the main connection but complains about the unencrypted elements - and it is right. In WordPress it is usually enough to go to Settings → General and set both addresses (WordPress and site) to https://, then for older content run a database search and replace of http://yourdomain with https://yourdomain (there are safe migration plugins for this). After the replacement, check a few of the oldest posts - that is where old hardcoded addresses usually hide.
Is it dangerous for Google rankings?
Briefly: one day with an expired certificate will not wreck your rankings. But Google has treated encryption as a baseline for years - a site that regularly scares people with warnings loses both trust and quality signals. Separately: a red screen can be a symptom of something more serious - if strange redirects or foreign content are showing up alongside it, read the recovery plan for a hacked site, because this may not be a certificate matter at all.
Frequently asked questions
Does an SSL certificate have to cost money? For an ordinary company site and store - no. Let’s Encrypt is free and technically equivalent to paid certificates in the basic scope. Paid variants make sense in specific corporate use cases, not for a typical business.
The site works for me but customers see a warning - how is that possible?
Your browser may have remembered the old, good state, or some visitors arrive on an address variant the certificate does not cover (for example with www). Check the site in a private window and on both address variants.
What does a professional fix cost? Renewing and sorting out a certificate together with redirects is short, predictable work - hours, not days. I give the quote in writing after checking the site.
Would rather not watch over it every month yourself? I take sites and stores under ongoing care - backups, updates, monitoring, and priority when something breaks. Tell me what you run and I will send back scope and price.