A customer emails to say your website is showing a full-page red warning. You open it on your phone and it looks fine; you open it on a laptop and see "Your connection is not private". Nothing changed on the site, nobody touched the hosting, and the message mentions a certificate you do not remember buying.
By the end of this guide you will be able to read that warning precisely, name the likely cause, and either fix it yourself or hand a technician a one-line brief instead of a vague complaint. The guides index covers broader security topics; this one is only about the padlock.
1. Read the error code, not the headline
Every browser shows a friendly headline and, below it or behind a details link, a specific code. The code is the diagnosis. The table below maps the common ones to their usual causes and to the person who can fix them.
| Error text you will see | What it means | Usual cause | Who fixes it |
|---|---|---|---|
CERT_DATE_INVALID / "certificate has expired" |
The certificate's validity window has passed | Automatic renewal stopped, or renewal was never automated | Host or whoever manages the server |
CERT_COMMON_NAME_INVALID / "does not match" |
Certificate is valid, but for a different hostname | www versus bare domain, a new subdomain, or DNS pointing at the wrong server |
Host, DNS administrator |
CERT_AUTHORITY_INVALID / "not trusted" |
Browser cannot build a chain to a trusted root | Self-signed certificate, missing intermediate certificate, or a proxy origin certificate exposed directly | Host or proxy administrator |
| Padlock missing, page loads, console shows mixed content | Certificate is fine; one or more resources load over http:// |
Hard-coded image, script or embed URLs from before the site had HTTPS | Site editor or developer |
ERR_SSL_PROTOCOL_ERROR / handshake failed |
Server and browser could not agree on how to encrypt | Server misconfiguration, very old server software, or a port serving plain HTTP | Host |
Record the exact code, the time you saw it, and whether it appears in a private window on a second network such as a phone on mobile data. A warning that shows only on one office computer with an out-of-date operating system is a different problem from one the whole internet sees.
Do not change DNS, hosting plans or certificates until you have read the code; a rushed fix for the wrong cause creates a second outage on top of the first.
2. Expired: the renewal stopped running
As of 2026, the Let's Encrypt FAQ states that its default certificates are valid for 90 days and recommends renewing them every 60 days; it also offers an opt-in six-day variant. Most shared hosts and control panels renew these automatically, which is why the owner never sees a renewal date. When the automation breaks, the first symptom is the browser warning roughly three months after the last successful run.
The CA/Browser Forum's ballot SC-081, adopted in 2025 with the votes of Apple, Google, Microsoft and Mozilla, schedules the maximum validity of public TLS certificates to fall from 398 days to 47 days in steps starting March 2026 and concluding March 2029. Any process that depends on a person remembering to renew will fail under that schedule; the practical upgrade is to confirm renewal is automated and monitored.
Common reasons an automated renewal stops:
- The domain's DNS was moved to a proxy or another provider and the renewal challenge can no longer reach the server.
- A firewall or security plugin started blocking the validation request.
- The hosting plan's certificate feature was switched off during a plan change or account migration.
- The certificate was purchased manually years ago and the renewal email went to a former employee or developer. If that person is also the only one with hosting access, read regaining control of your domain and hosting first.
Ask your host one precise question: "Which system renews the certificate for this hostname, when did it last succeed, and what did the most recent attempt log?" If the answer is "you renew it yourself", budget a short technician job to move the site to automated issuance. Buying another one-year certificate restarts the clock without removing the failure mode.
3. Name mismatch: the certificate is for a different hostname
A certificate lists the exact hostnames it covers. example.com and www.example.com are different names, and a certificate issued for one does not cover the other unless both were included. The mismatch error typically appears after one of these events: a new subdomain was created without a certificate, DNS for one name was pointed at a different server, or the site was moved and the old server still answers for the old address.
Check both the bare domain and the www version in a private window. If one works and the other warns, the fix is to request a certificate that covers both names, or to redirect the uncovered name at the DNS or server level before the browser ever asks for a certificate. The redirect checklist covers the canonical-hostname decision that this error usually exposes.
Do not solve a mismatch by deleting the "broken" hostname from DNS if customers, email signatures or printed material use it. Fix the certificate coverage instead.
4. Not trusted: a chain problem or an exposed origin
Browsers trust a certificate only when they can follow it through intermediate certificates to a root they already know. A server that omits the intermediate will work on devices that have cached it and fail on others, which is why this error often looks intermittent.
The other frequent cause is a proxy. If your site sits behind Cloudflare, visitors see Cloudflare's certificate while the connection from Cloudflare to your server uses whatever the host provides. As of 2026, Cloudflare's encryption modes documentation describes five modes; in Full (strict) the origin's certificate is validated and may be issued by a public authority or by Cloudflare's own Origin CA. An Origin CA certificate is trusted by Cloudflare, not by browsers, so if DNS is ever switched from proxied to direct, every visitor gets the untrusted-issuer warning at once. The same page notes that Flexible mode leaves the hop between Cloudflare and your server unencrypted, which is not a repair.
If you use a proxy, write down which mode the zone is in and whether the origin holds a public or an origin-only certificate. Our guide to Cloudflare in front of a shared host explains the trade-offs of each layer.
Do not switch a zone to Flexible mode to make a warning disappear. It hides the symptom by removing encryption on half the path and can create redirect loops.
5. Mixed content: the certificate is fine, the page is not
Sometimes the padlock is missing or shows a warning icon but no full-page error appears. The certificate is valid; the page itself is requesting at least one resource over plain http://. The MDN mixed content reference explains that browsers now auto-upgrade images, audio and video requested over HTTP and block scripts, stylesheets, iframes, fonts and fetch requests outright. A blocked script can silently break a form or a menu, so mixed content is a functional problem as well as a trust one.
The typical sources are hard-coded http:// URLs in page content, theme settings, embedded maps or videos, and old links to your own domain from before HTTPS existed. Open the browser's developer console on the affected page; the blocked requests are listed with their URLs. Fix each at the source by changing the URL to https:// or to a scheme-relative path, and look for a site-wide setting or database search-and-replace if there are many.
Do not install a plugin that rewrites every URL at page load as a permanent fix. It adds work to every request and masks the content that still needs correcting.
6. The ten-minute triage and when to call someone
- Open the site in a private window on two networks; record the exact error code and time.
- Click the padlock or warning, view the certificate, and note the issuer, the hostnames listed and the expiry date.
- Test both the bare domain and
www. - If expired: ask the host which system renews it and when it last succeeded.
- If mismatched: identify which hostname is uncovered and whether DNS for it changed recently.
- If untrusted: ask whether an intermediate is missing and whether a proxy origin certificate is exposed.
- If the padlock is merely missing: open the console and list the
http://resources. - After any fix, re-test in a private window and on a phone; browsers cache certificate state, so a stale tab proves nothing.
Owner-led diagnosis typically takes 30-90 minutes. Repairing renewal automation or moving to a proxy with a validated origin is typically a 1-4 hour technician job, with a CAD 150-600 planning allowance as an editorial estimate rather than a quote. A hosting migration is not a certificate repair; if someone proposes one, ask which of the five causes above it addresses.
Finally, ask your host whether expiry notifications can go to a shared mailbox rather than one person. Short certificate lifetimes reward sites that automate and punish sites that remember.
— Editorial team. Facts current as of 2026; we revise guides when the ground shifts.
Frequently Asked Questions
Is a certificate warning a sign my website was hacked?
Usually not. The common causes are an expired certificate, a certificate issued for a different hostname, or a page that still loads one image or script over plain HTTP. A compromise is possible but is rarely the first explanation; check expiry and hostname before assuming the worst.
Can I just tell visitors to click through the warning?
No. Modern browsers make the bypass deliberately hard, some block it entirely for sites that use HSTS, and asking customers to ignore security warnings trains them to ignore the real ones. Fix the certificate; the fix is usually quick once the cause is known.
Why do certificates expire so often now?
As of 2026, automated certificate authorities such as Let's Encrypt issue 90-day certificates by design, and the CA/Browser Forum has adopted a schedule that reduces the maximum lifetime of all public certificates in steps through 2029. Short lifetimes are only a problem when renewal is manual; the fix is automation, not a longer certificate.