When a certificate expires, browsers stop trusting the connection entirely — visitors see a full-page security warning ("Your connection is not private") rather than a small icon change, and most will leave rather than click through it.
Immediate impact
- Visitor trust and conversions drop sharply, often within minutes of expiry
- Some browsers/API clients will refuse the connection outright rather than just warning
- Any integrations calling your site over HTTPS (webhooks, APIs) may start failing
Preventing it
Automate renewal rather than relying on manual calendar reminders — tools like Certbot renew Let’s Encrypt certificates automatically well before their 90-day expiry. Set up an independent monitor that checks certificate expiry directly, since automation itself can silently fail.
FAQ
How far in advance should I get warned?
At least 14–30 days before expiry, so there’s time to fix a failed auto-renewal before it becomes a live outage.