Visitors get a warning, not your page

An SSL certificate is what lets a browser trust an HTTPS address. It has an end date. After that date, current browsers stop on a full-page warning and do not show the site.

Chrome calls the connection not private and reports an error such as NET::ERR_CERT_DATE_INVALID. Safari and Firefox stop in the same way: the certificate date is invalid, and continuing means opening an advanced option that most people never use. They close the tab.

The page behind the warning can be fine. The server can be on, DNS can be right, and the homepage can still answer. The browser is rejecting the certificate date.

The date is easy to miss

Public certificates last for a limited time. Let’s Encrypt certificates last about 90 days, and many hosts renew them without sending a reminder. Other certificates last longer, and they still end. Renewal is quiet when it works, so the first visible sign of a failure is often the browser warning.

Automatic renewal fails for ordinary reasons:

  • The domain no longer points at the host that renews the certificate
  • The host still expects a challenge file or a DNS record that is gone
  • A new panel replaced the one that used to renew the certificate, and the new one never took over
  • Someone installed the certificate by hand and never put the end date on a calendar

This shows up on sites that were set up once and then left alone. The lock icon looked fine the last time you opened the page.

Read the end date while the site still loads

Opening the site today only tells you that the certificate is valid right now. The useful number is the end date.

In the browser, open the certificate details from the address bar and read the field named “Valid to” or “Expires”. On a Mac or Linux machine you can also ask the server:

openssl s_client -servername example.com -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -noout -enddate

Replace example.com with your hostname. The command prints a line like notAfter=Mar 10 12:00:00 2027 GMT. When that date is inside the next few weeks, renew before it arrives. If you wait for the warning, every visitor hits the block while the host is being fixed.

Where you renew depends on the host: a hosting panel, a CDN, or a certificate on your own server. Browsers use the date on the certificate the public site is presenting, so that is the date to read.

A date error is one kind of certificate warning

Browsers also warn when the certificate name does not match the address, or when they do not trust the issuer. Those are different problems. An expiry warning means the name and the issuer were acceptable, and the date has passed. Changing DNS, or replacing the whole site, does not clear a warning whose cause is the end date.

If the warning is already up

Renew the certificate where it is issued, then open the site in a private window. The warning clears once the server presents a certificate whose end date is still ahead. A normal reload can keep the old error for a while. A private window is a cleaner check.

A one-time look does not watch the site

Checking the lock icon when you happen to visit is enough for a site you open every day. It is a weak habit for a site you edit only sometimes, or for several URLs: the marketing site, the shop, a campaign page on another host. Each address can carry a different certificate.

A monitor that reads the expiry date can show that date while the page still loads, and can flag a URL that needs renewal before the browser warning starts. That check is separate from uptime. Uptime asks whether the URL responds. The certificate check asks how long the current certificate stays valid.

SiteOK reads the expiry date for each HTTPS URL you add. The phone dashboard shows that date, and an SSL warning when a URL needs renewal, next to whether the page is up or down. Nothing is installed on the server. Checks run every 30 minutes. The weekly email includes SSL expiry for each URL. When a renewal is detected, SiteOK sends the new expiration date and keeps watching that certificate. The detail screen keeps seven days of check history beside the date.

To see the date for a public URL, start a free trial. No signup is required.