In this guide · 8 sections
- 01First, read the error: expired, wrong name or broken chain
- 02Why SSL certificates expire without warning
- 03How to fix an expired certificate on shared hosting
- 04Cloudflare: SSL modes and error 526
- 05Name mismatch and chain errors
- 06Stop it happening again: monitoring
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Click the padlock or warning to see the certificate's expiry date. If it has expired, renew it in your hosting panel (usually a free Let's Encrypt AutoSSL button) and find out why auto-renewal failed, most often DNS pointing elsewhere or a Cloudflare setting.
First, read the error: expired, wrong name or broken chain
The browser warning looks the same to visitors, but the error code underneath tells you what is wrong. In Chrome, the code is shown in small text below the warning; click it for details. You can also open the padlock or "Not secure" label and view the certificate to see who issued it, which domains it covers and its validity dates.
| Error code (Chrome) | What it usually means | Typical fix |
|---|---|---|
| NET::ERR_CERT_DATE_INVALID | Certificate has expired, or the visitor's clock is wrong | Renew the certificate and fix auto-renewal |
| NET::ERR_CERT_COMMON_NAME_INVALID | Certificate does not cover this exact domain (for example www vs no www) | Reissue covering both the root domain and www |
| NET::ERR_CERT_AUTHORITY_INVALID | Self-signed certificate or missing intermediate certificate | Install a public certificate with the full chain |
| Cloudflare error 526 | Cloudflare cannot validate your origin server's certificate | Fix the origin certificate; see the Cloudflare section |
If only one person sees the error, check their computer's date and time first. If everyone sees it, it is your certificate.
Why SSL certificates expire without warning
Most small business sites use free certificates from Let's Encrypt, issued automatically by the hosting company. Let's Encrypt's FAQ says its default certificates are valid for 90 days and recommends renewing every 60 days. Renewal happens in the background, so nobody notices until it fails.
Two changes made silent failures more likely. Let's Encrypt ended its expiry reminder emails on 4 June 2025, so many owners no longer get a warning. And certificate lifetimes across the industry are shrinking, which means more renewals and more chances to fail.
| Date | Change |
|---|---|
| 15 March 2026 | Maximum public TLS certificate lifetime cut to 200 days |
| 15 March 2027 | Maximum lifetime cut to 100 days |
| 10 February 2027 | Let's Encrypt default certificates drop from 90 to 64 days |
| 16 February 2028 | Let's Encrypt default certificates drop to 45 days |
| 15 March 2029 | Maximum public TLS certificate lifetime cut to 47 days |
The schedule comes from the CA/Browser Forum, summarised in DigiCert's explainer, and from Let's Encrypt's move to 45-day certificates. If you still buy a yearly certificate and install it by hand, that routine no longer works: certificates now last months, not years.
Cloudflare: SSL modes and error 526
If your site is behind Cloudflare, there are two certificates: one Cloudflare shows to visitors (renewed by Cloudflare) and one on your own server. Cloudflare's SSL/TLS encryption modes decide how strictly Cloudflare checks your server's certificate.
- Off: no encryption. Do not use.
- Flexible: visitor to Cloudflare is encrypted, Cloudflare to your server is not. Can cause redirect loops on WordPress.
- Full: encrypted to your server, but Cloudflare does not validate the server's certificate.
- Full (strict): encrypted and validated. Recommended, but an expired or wrong certificate on your server breaks the site.
Cloudflare's error 526 page explains that this error appears when the mode is Full (strict) and Cloudflare cannot validate your server's certificate, for example because it has expired, is self-signed, does not include the domain or is missing intermediate certificates. Switching to Full is a quick workaround. The proper fix is renewing the server certificate or installing a free Cloudflare Origin CA certificate, then going back to Full (strict).
Name mismatch and chain errors
A certificate that covers yourdomain.com but not www.yourdomain.com produces a name error for anyone who types www. Reissue the certificate with both names, and set one version to redirect to the other.
Chain errors happen when the server sends only your certificate without the intermediate certificate that links it to a trusted root. Browsers on some phones or older devices then reject it. This is common after someone installs a paid certificate by hand. Reinstall it with the full chain file from the issuer, or let the host's AutoSSL replace it.
Mixed content is a different problem. If the padlock shows but with a warning, the certificate is fine and the page loads some images or scripts over http. Update those links to https.
Stop it happening again: monitoring
Renewal will fail again at some point, because DNS, hosting and plugins change. The goal is to hear about it before customers do.
SSL monitoring checklist
Let's Encrypt suggests third-party monitoring now that it no longer sends reminders. Several services offer free expiry alerts for a handful of certificates; a paid uptime monitor that also checks SSL and domain expiry covers everything in one alert.
Do it yourself or get help?
If you can log in to your hosting panel and the problem is a plain expiry, you can fix it yourself in minutes using the steps above. Get help when renewal keeps failing, when Cloudflare and the host disagree, or when you cannot find who controls the domain and hosting.
Our Quick Fix (S$119, one hour of remote work) covers diagnosing and renewing a certificate and fixing the renewal. The Monitor plan (S$29 a month) checks uptime every five minutes and alerts you before SSL certificates or domains expire. For context on hosting and support budgets, see website costs in Singapore and IT support costs.
Frequently asked questions
Either the certificate has expired, it does not cover the exact address the visitor used (for example www), the server is missing an intermediate certificate, or the page loads some images or scripts over plain http. Click the warning in the browser to see the error code and certificate dates, then fix the matching cause.
Let's Encrypt certificates, the free kind most hosts use, last 90 days and are meant to renew automatically. Since 15 March 2026, no public certificate can be valid for more than 200 days, dropping to 100 days in March 2027 and 47 days in March 2029. Yearly certificates installed by hand are no longer possible.
For most small business websites, no. Free certificates from Let's Encrypt or your host give the same encryption and padlock as paid ones. Paid certificates add organisation validation and support, which some larger businesses want, but they still need renewing more often than before and do not prevent expiry problems.
It means Cloudflare is set to Full (strict) mode and cannot validate the certificate on your own web server, usually because it expired, is self-signed or does not cover the domain. Switching to Full is a temporary workaround. The real fix is renewing the server certificate or installing a Cloudflare Origin CA certificate.
The bigger and more immediate damage is to visitors: they see a full-page warning, many leave, and forms and payments stop working. Search crawlers can also run into the same certificate error when fetching your pages. Fix it the same day and check Search Console afterwards for crawl errors.