Certificate Renewal
Definition
Every HTTPS site presents a certificate with a fixed validity window, and browsers check the expiry date on each connection. Certificates from Let's Encrypt are valid for 90 days and are designed to be renewed by software at around 60 days; paid certificates have historically run for a year, and the maximum lifetime allowed by browsers is being reduced step by step towards a much shorter window. Renewal is not a patch to an existing certificate — a new one is issued, validated and installed, and the old one simply stops being served. Managed platforms do this for you: the host proves control of the domain, issues the certificate and swaps it in with no downtime and no notification. This is the second of the two silent failures that take sites down, and it is silent because nothing is wrong until the exact moment everything is.
Why It Matters
An expired certificate is worse than an ordinary outage. Browsers do not degrade politely; they show a full-page interstitial saying the connection is not private, and on a site with HSTS enabled there is no click-through option at all. Visitors read that screen as a compromised or fraudulent site, so the reputational cost outlives the fault. It also breaks anything automated that fetches from your domain — API clients, webhooks, feed readers — usually with an error message that mentions nothing about certificates. And it always happens at an inconvenient hour, because expiry times are set by the issuer, not by you.
How It Works
Confirm who is responsible before you need to know. On a managed static host the answer is the platform, and renewal happens in the background provided the DNS still points at them — which is the catch, because a certificate cannot be reissued if the domain validation now fails. If you run your own server, renewal is a scheduled job such as certbot renew, and the two things that break it are a firewall change blocking the validation request on port 80 and a reload step that never runs, so the new certificate sits on disk while the old one is still being served. Either way, monitor the expiry from outside: a check that reads the certificate presented by your domain and alerts at 30, 14 and 7 days catches both cases. Test after any DNS change and any new subdomain, since a certificate that does not cover a new name fails for that name alone while the rest of the site looks fine.
Real-World Example
An architecture practice serves a set of case studies at oakfield-cases.99helpers.site with a custom domain. The certificate is issued and renewed by the host, so for two years nobody touches it. When they add a second subdomain for a specific project, they point it at the platform correctly and the certificate for it is issued within minutes — but a stale A record left over on an old subdomain fails validation, and the external expiry check is what surfaces it two weeks before anything would have broken. The fix is deleting one record nobody had used since 2023.
Common Mistakes
- ✕Assuming renewal is automatic everywhere — it is on most managed hosts, but a self-managed server, a load balancer or an older control panel may need the certificate installed by hand
- ✕Renewing the certificate but not reloading the server, so the new file sits unused and the expired one keeps being served
- ✕Letting the validation path break — a firewall rule, a redirect on the ACME challenge path or a DNS change can silently stop reissue while the current certificate is still valid
- ✕Trusting only the issuer's reminder emails, which go to whatever address was used when the certificate was first set up
Related Terms
SSL Certificate
A small signed file that proves a server is genuinely the one answering for a given hostname, so a browser will open an encrypted connection to it. Everyone calls it an SSL certificate, though the protocol it is used with has been called TLS for years.
HTTPS
HTTP carried inside an encrypted TLS connection, shown in the browser as an https:// address. It is the same web protocol as before, with the traffic protected and the server's identity checked first.
Domain Expiry
The date a domain registration runs out. Missing it takes the site and its email offline immediately, and recovering the name gets progressively harder and more expensive over the weeks that follow.
Uptime Monitoring
An outside service that requests your site on a schedule and tells you when it stops answering correctly. It exists so that you find out about an outage before your visitors have to tell you.
Mixed Content
A page loaded over an encrypted connection that pulls in at least one image, script, stylesheet or font over plain HTTP. The browser responds by removing the padlock, and for anything that can run code, by refusing to load it at all.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →