SSL Warning

Your site says “not secure,” and you can feel customers backing away.

Often a 30-second fix you can do yourself. Here’s how, and what it means when the warning won’t clear.

The site is technically running. Nobody’s seeing it. A full-screen security warning stops visitors before your homepage loads, so treat this as downtime and fix it like downtime.

Try the 30-second check

Text 562-726-2287

Free to try. If reissuing doesn’t clear it, you get a written diagnosis and a fixed price, and you decide.

30 sec

To read the expiry date

$0

Reissuing is free

~4 hrs

To a diagnosis if it’s the other kind

The short answer

An expired or broken SSL certificate makes every browser show a full-screen warning before your site loads. Most people leave at that screen, so treat it as downtime even though the site is technically running.

Check the expiry first. It takes thirty seconds. Click the padlock or the warning icon in the address bar, open the certificate details, read the valid-to date. If it’s in the past, the certificate simply expired and auto-renewal failed.

Then reissue from your host’s control panel. Nearly every host has a one-click SSL or Let’s Encrypt option. Reissuing is free and it’s safe to try. Give it a few minutes to take effect.

If reissuing doesn’t clear the warning, stop. At that point it isn’t an expiry problem. It’s either mixed content, where the page loads some resources over plain HTTP, or an incomplete certificate chain. Both need someone to look at what the page is actually loading.

Text 562-726-2287 or describe it here and you’ll have a written diagnosis and a fixed quote in about 4 business hours. Free.

Is this you?

Check you’re on the right page.

If nothing loads at all, rather than a warning appearing first, you want the site is down instead.

Your site now warns visitors it isn’t secure, and you can feel them backing away
A full-page warning that the connection is not private
The padlock is missing, crossed out, or showing a warning triangle
It started suddenly, with nobody touching the site
Some pages warn and others don’t
Your host says the certificate is installed, and the browser still disagrees

What’s actually causing it

Four causes, in the order they usually turn out to be.

01 Most common

Auto-renewal failed

Most certificates renew themselves every 90 days. When that breaks, nothing announces it. The certificate lapses on its expiry date and the warning appears the same morning. This is the cause by a distance.

DNS moved and the certificate didn’t follow

You changed hosts, added a subdomain, or moved a record, and the certificate still covers the old configuration. Common on www versus non-www mismatches, where one address works and the other warns.

Mixed content

The certificate is fine and current, but the page pulls in an image, a script or a font over plain HTTP, and browsers treat that as insecure. This is your cause when the padlock is degraded rather than the site being blocked outright, and when some pages warn while others don’t.

An incomplete chain

The certificate installed correctly but the intermediate certificate is missing. Desktop browsers often tolerate it and mobile browsers often don’t, which gives you the maddening “it works on my laptop” version of this problem.

What you can try yourself

The version you can fix yourself.

Cause 01 is most of them, and it’s a button. Work through these three and you’ll either be fixed or you’ll know which of the harder three you’ve got.

Read the expiry date

Click the padlock or warning icon, open certificate details, look at valid-to. A date in the past means expiry, and that’s the easy case.

Reissue from your host’s panel

Look for SSL, TLS or Let’s Encrypt. It’s free and it’s safe to try. Give it five minutes, then reload in a private window so you aren’t looking at a cached warning.

Check both www and non-www

Load your site both ways. If one warns and one doesn’t, the certificate doesn’t cover both names, and your host can reissue with both included.

When to stop

Stop here

If you reissued and the warning is still there, stop.

You’re now looking at mixed content or a chain problem, and neither gets fixed from a control panel. Mixed content means finding every resource on the page that loads over HTTP, which on a WordPress site usually means the database is holding old http:// URLs from before the certificate existed. Search-and-replacing those wrongly breaks things that were working.

Also stop if your site takes payments. A certificate warning on a checkout is an outage, and guessing at it while orders fail is the expensive way to learn.

What we do about it

We work out which of the four it is, then fix that one.