An expired SSL certificate turns your website into a full-screen browser warning telling visitors it isn’t safe. It’s one of the most damaging failures on this list, and one of the most avoidable.
SSL — more accurately TLS — is what puts the padlock in the address bar and the S in https. It encrypts the connection between your visitors and your website, so anything submitted through a form, a login or a checkout can’t be read in transit.
It’s no longer optional. Browsers mark sites without it as “Not secure” in plain language, and search engines have treated it as a ranking signal for years. For any site that takes enquiries, logins or payments, it’s a baseline requirement rather than an upgrade.
The problem isn’t getting a certificate. It’s keeping one.
Certificates expire — and the window is closing fast. On 15 March 2026 the maximum validity for a public TLS certificate dropped to 200 days, down from 398. It falls again to 100 days in March 2027, and to 47 days in March 2029. Most certificate authorities issue a day inside the limit — 199 days at present — so they never trip over it.
Read that as a business risk rather than a technical footnote. A renewal task that used to come round roughly once a year will shortly arrive every three months, and before long every six weeks. Any process that depends on a person remembering will fail — not as a matter of bad luck, but as a matter of arithmetic.
This is the single strongest argument for handing certificates to someone who automates them. Manual SSL renewal is on its way to being unworkable.
The failure is always the same shape: the certificate was installed once, by someone who has since left or moved on, using a process nobody documented. Nobody knows when it expires. The reminder goes to an address nobody monitors. Then one morning every visitor to your website is met with a red warning page, and the person who knows how to fix it is unavailable.
Meanwhile your contact form stops being submitted, because almost nobody clicks through a security warning to fill in a form.
What we do
- Issue and install the certificate correctly, including the full chain — a partially installed certificate works in some browsers and fails in others, which is a genuinely miserable fault to diagnose.
- Renew automatically, well before expiry, without anyone needing to remember.
- Cover the right names. Certificates need to cover every hostname people actually use. A certificate valid for
example.co.ukbut notwww.example.co.ukthrows a warning for half your visitors. - Force https properly, so the secure version is the one people land on and old http links redirect rather than break.
- Fix mixed content — the images, scripts and stylesheets still loading over http that quietly downgrade the padlock even when the certificate is perfect.
- Monitor expiry, so if anything does go wrong with renewal we find out with time to act rather than after the fact.
Which certificate you actually need
There’s more marketing around certificate types than there is difference between them. The encryption is identical. What varies is how much the issuer verifies before handing one over.
Domain Validated (DV)
Confirms you control the domain. Issued in minutes. Appropriate for the large majority of business websites, including sites taking enquiries and logins.
Organisation Validated (OV)
The issuer verifies your company exists as a registered entity. Your organisation details are embedded in the certificate for anyone who inspects it. Worth considering if you’re in a regulated sector or your customers check.
Extended Validation (EV)
The most thorough vetting. Historically this produced a green company name in the address bar — browsers removed that display some years ago, which removed most of the practical benefit. We’ll be straight with you: for most businesses, EV is no longer worth the premium.
Wildcard and multi-domain
A wildcard covers unlimited subdomains of one domain — useful if you run shop., portal. and mail. as well as the main site. Multi-domain certificates cover several separate domains at once.
We’ll recommend the cheapest option that genuinely fits, and tell you when a more expensive one isn’t buying you anything.
Included with hosting
If your site is on our hosting, certificates are issued, installed and renewed as part of the service. There’s nothing to arrange and nothing to remember.
Get your certificates handled
Call 01202 835235 or email contact@domainwarden.co.uk. If you’re not sure when your current certificate expires, we can tell you in about a minute.