Your SSL certificate broke: a 5-minute checklist

A certificate warning is one of the few problems that stops a business website dead — visitors see a full-page red interstitial and most of them leave immediately.

The good news is that the cause is nearly always one of five things, and you can rule out four of them in under a minute each.

1. Has it simply expired?

The single most common cause. Certificates from Let's Encrypt last 90 days and renew automatically — right up until the renewal cron job stops running and nobody notices for three months.

# Check the expiry date of any domain's certificate
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates

If notAfter is in the past, that's your answer. Renew it, then find out why the automatic renewal stopped.

2. Is the domain name actually on the certificate?

A certificate issued for example.com does not cover www.example.com unless the www variant was explicitly included. Visitors hitting the other version get a name-mismatch error.

Same command as above, but look at the subject alternative names:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -text \
  | grep -A1 "Subject Alternative Name"

Both example.com and www.example.com should be listed.

3. Is the intermediate certificate missing?

This is the confusing one: the site works perfectly in your browser and fails on someone's phone.

Certificates come in a chain — your certificate, signed by an intermediate, signed by a trusted root. Desktop browsers often cache intermediates from other sites they've visited and paper over the gap. Mobile browsers usually don't.

Fix it by installing the full chain bundle your certificate authority provided, not just the certificate file.

4. Is something being served over plain HTTP?

The padlock disappears when a page loads any resource over http:// — one image, one font, one old analytics script. This is "mixed content".

Open the browser console and look for mixed-content warnings; they name the exact URL. On WordPress this is usually hardcoded http:// URLs left in the database after a migration.

5. Is Cloudflare set to the wrong SSL mode?

If you're behind Cloudflare and seeing redirect loops or certificate errors, check the SSL/TLS mode in the dashboard:

Setting Flexible on an origin that already redirects HTTP to HTTPS produces an infinite redirect loop. It's a five-second fix once you know.

If it's still broken

Run the domain through SSL Labs and read the report — it identifies chain problems, protocol mismatches and weak configurations that the browser error message never explains.

And once it's fixed, set up an expiry monitor. Finding out from a customer is the expensive way to learn your certificate lapsed.