SSL/TLS certificates expire on a fixed schedule (often 90 days for free certificates like Let's Encrypt) — when one lapses, every visitor sees a full-page "your connection is not private" warning instead of your site, with no way to click through easily on modern browsers.
An expired SSL certificate makes your site inaccessible — browsers block it with a full-screen warning and Google deindexes it. Certificates should be set to auto-renew.
A valid SSL certificate is the actual cryptographic foundation that makes HTTPS encryption possible at all — without a genuine, properly configured certificate from a trusted certificate authority, browsers cannot establish the secure connection HTTPS is meant to provide, regardless of any other security configuration on your server.
Certificate validity involves several genuine technical dimensions beyond simple presence — the certificate must be issued by a certificate authority browsers actually trust, must not have expired, must genuinely match the domain it's protecting, and must be properly chained to a valid root certificate, with failure on any of these dimensions producing browser warnings that functionally block or severely deter visitor access.
Expiration represents a particularly common, entirely preventable failure mode — certificates carry real expiration dates, and a certificate that quietly expires without renewal produces sudden, severe visitor-facing warnings with no advance notice to visitors, making automated renewal configuration a genuinely important safeguard against this specific, avoidable failure.
Beyond the direct visitor-trust and browser-warning consequences, an invalid or expired certificate effectively negates every other security measure built on top of HTTPS — headers like HSTS, secure cookie flags, and other protections discussed elsewhere in this security work all depend on genuinely valid, functioning certificate-based encryption as their foundation.
Your certificate has more than 30 days remaining before expiry, and auto-renewal is confirmed active.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →