SSL Certificate Expired? How to Fix Not Private Warnings

1. What Does “SSL Certificate Expired” Mean?

Quick Answer: An expired SSL certificate means the digital ID that proves your website is genuine has passed its end date. Browsers no longer trust it, so they show a full-page “not private” warning before your site loads. The encryption itself still exists, but visitors are told the connection may be unsafe.

Every certificate has a start date and an end date. When the end date passes, browsers treat the certificate like an expired passport: real, but no longer valid. Our plain-English explainer on SSL and HTTPS covers how certificates work. Customers may describe the warning in different words depending on their browser:

If the page does not load at all and the browser says it “can’t provide a secure connection”, that is a handshake failure instead. Our guide to the SSL protocol error on your website covers that case.

2. Is the Certificate Expired or Is the Device Clock Wrong?

Quick Answer: Browsers judge expiry using the device’s own clock, so a laptop set to the wrong date shows the same warning. If the warning appears on every phone and computer, your SSL certificate has expired. If only one device complains, fix that device’s date, time zone and browser first.

Spend five minutes confirming before you call anyone:

1. Test on mobile data. Open the site on your phone with Wi-Fi off. If it loads cleanly, the problem is the device or office network.
2. Check the device clock. The time zone should be Kuala Lumpur (GMT+8) and the date set automatically.
3. Read the certificate dates. Click the warning icon in the address bar and open the certificate details. The “Expires on” or “Valid to” date tells you the answer.
4. Run an outside test. The free SSL Server Test by Qualys SSL Labs shows the expiry date and flags certificate problems from outside your network.

Also test both yourdomain.com.my and www.yourdomain.com.my. Sometimes only one version has lapsed, for example when the www address points somewhere else after a DNS change. If you recently moved your domain, read why DNS may not be propagating after a domain change.

3. Why Did My SSL Certificate Expire? Causes Ranked by Likelihood

Quick Answer: Most certificates renew automatically, so an expiry usually means renewal failed quietly. The top cause is a domain validation check that failed after a DNS or CDN change. Next come unpaid or suspended hosting, a paid certificate renewed but never installed, and a domain that now points somewhere else.

When Malaysian SMEs bring us an expired certificate, the real question is “why did renewal stop working?” The chart shows what we usually find.

What each cause looks like in practice:

• Failed domain check. Free certificates renew only if the issuer can confirm you still control the domain. Move DNS to a CDN or a new host and that check can fail silently. If you also see timeouts, read our guide to Cloudflare error 522.
• Unpaid hosting. A company card expires, the RM invoice goes to an ex-staff email, and the host suspends the account, including its renewal jobs.
• Renewed but not installed. A paid certificate was renewed and invoiced, but nobody installed the new file on the server.
• Domain problems. If the domain lapsed or now shows a holding page, see how to fix a domain showing a parked page. A half-finished move can also stall; see how to get your .my domain transfer code.

4. How to Fix an Expired SSL Certificate Step by Step

Quick Answer: Settle any unpaid hosting first, then open your hosting panel’s SSL section and reissue the free certificate for your domain and www. If you use a paid certificate, renew it and install the new file. Check the CDN certificate too, clear every cache and retest from outside your network.

Work through these steps in order. Each one removes a cause from the chart above:

1. Settle the hosting account. Log in to your hosting billing area. If the account is suspended or an invoice is overdue, pay it and update the card. Nothing else works until the account is active.
2. Check the certificate status. In cPanel, go to Security, then SSL/TLS Status. The cPanel SSL/TLS Status documentation explains how this page lists each domain’s certificate and its status.
3. Reissue the free certificate. Where your host offers AutoSSL or a Let’s Encrypt tool, run it for both the root domain and www. If the run fails, the error message usually names the failed domain check.
4. Fix the domain check if it fails. Make sure the domain’s DNS records point to the server that is asking for the certificate. After a recent DNS edit, allow time for the change to spread.
5. Renew and install a paid certificate. Renew with the issuer, then install the new certificate file in your hosting panel. Renewal alone does not replace the old file.
6. Check your CDN. If you use Cloudflare or a similar service, confirm its edge certificate shows as active and that your server certificate is valid too.
7. Clear caches and retest. Purge your caching plugin and CDN cache, then rerun the SSL Labs test and check both addresses on mobile data.

Once the certificate is valid, open Search Console and check the Pages report for crawl errors. Look at enhancements as well, because a broken HTTPS period often surfaces alongside structured data errors and rich result warnings.

5. How Long Until the “Not Private” Warning Goes Away?

Quick Answer: A free certificate reissue usually clears the warning within minutes to a few hours. A suspended hosting account adds the time your host takes to reactivate it. Paid business-validated certificates need a few working days for document checks, so a free certificate is the fastest way back online.

Use this table to set expectations with your team and your boss:

For an organisation-validated certificate, the issuer checks that your company is real, so keep your SSM documents ready and answer the publicly listed company phone. Stuck waiting? Install a free certificate first, then swap in the paid one later.

6. What Else Breaks When an SSL Certificate Expires?

Quick Answer: More than the home page. Ad platforms may reject or stop ads with an unsafe landing page, product feeds can stall, analytics loses visits that never load, and mail apps throw certificate pop-ups. Check each channel once the certificate is fixed, because some will not recover by themselves.

Use this checklist after the fix to catch the knock-on effects:

For paid channels, check why Google Shopping ads stop showing and why Meta catalogue products get no impressions. In analytics, outage days can leave odd rows; see what (not set) in GA4 reports means and why GA4 custom events stop showing. For mail, learn why a business email is not receiving messages.

7. How to Stop Your SSL Certificate Expiring Again

Quick Answer: Rely on automatic renewal, but watch it. Certificate lifetimes are shrinking every year, and some issuers no longer email expiry reminders, so add an outside monitor that alerts you weeks before expiry. Keep hosting billing current and recheck renewal after every DNS, CDN or hosting change.

Renewals now happen far more often than they used to. Let’s Encrypt’s FAQ says its standard certificates last 90 days. Let’s Encrypt also stopped sending expiration notification emails on 4 June 2025, so many owners no longer get a warning. Paid certificates are getting shorter too, under CA/Browser Forum Ballot SC081v3:

With renewals this frequent, build a routine that does not depend on memory:

• Automate renewal. Use AutoSSL or your host’s free certificate tool wherever possible.
• Add an outside monitor. Use a certificate or uptime monitor that alerts at least 14 days before expiry, sent to a shared inbox rather than one person.
• Keep billing current. Put RM hosting and domain invoices on a company card with a reminder before it expires.
• Recheck after every change. After any DNS, CDN or hosting move, confirm the next renewal will pass its domain check.
• Protect your domain email too. Moves that break renewals often break mail authentication; see how to stop someone spoofing your business email.

A dependable host makes all of this easier; compare options in our guide to web hosting in Malaysia.

8. When Should You Hand It to a Web Team?

Quick Answer: Escalate if renewal keeps failing after you reissue, if nobody has the hosting or DNS login, if the certificate is valid but the warning stays, or if this is the second expiry in a year. Each of these points to a setup problem rather than a one-off lapse.

Get help early in these situations:

• No access. The hosting, domain or DNS login sits with a former freelancer or staff member.
• Repeated failures. AutoSSL keeps reporting a failed domain check and you cannot see why.
• Several warnings at once. The site also shows a “Not secure” label or mixed content warnings after HTTPS.
• Revenue at stake. Ads, online orders or bookings depend on the site every day.

A secure, always-on site is one of the clearest website trust signals for new visitors. ZenWeb is a Google Partner agency that has worked with 500+ Malaysian businesses. Our web design services team sets up hosting, certificates and renewal monitoring so a lapse never reaches your customers.

9. Conclusion

When your SSL certificate has expired, the warning looks alarming, but the fix is usually quick. Confirm the expiry date, settle any hosting bill, reissue or install the certificate, then clear caches and retest. The bigger job is finding out why renewal failed and adding monitoring, because certificates now renew several times a year. For more help keeping your website working for your business, start at the ZenWeb home page.

10. Frequently Asked Questions

1. Is it safe for customers to click “Proceed” past the warning?

Do not ask them to. The warning means the browser cannot confirm the site is genuine, and many visitors will rightly refuse. Telling customers to bypass security warnings also trains them into unsafe habits. Fix the certificate instead; a free reissue often takes minutes.

2. My SSL certificate was set to auto-renew. Why did it still expire?

Automatic renewal only works if the issuer can still confirm you control the domain and the hosting account is active. A DNS or CDN change, an unpaid invoice or a suspended account will stop renewal quietly. Check those first.

3. Will an expired SSL certificate hurt my Google rankings?

A short lapse fixed within a day or two rarely causes lasting harm. A long one can, because visitors bounce off the warning and Google may crawl the site less. Fix it quickly, then check Search Console for crawl errors.

4. Do I need to buy a paid SSL certificate to fix this?

No. A free certificate from your host or Let’s Encrypt removes the warning and encrypts traffic just as well. Paid organisation-validated certificates add a company identity check using your SSM documents, which some businesses prefer, but they are not required.