Why Your SSL Certificate Might Show as Invalid

This is by far the most common cause, and it is almost always caused by an automated renewal that quietly stopped running rather than anyone forgetting on purpose. Certificates from free automated authorities like Let's Encrypt typically last ninety days, which means a broken renewal script can go unnoticed for months before it finally expires and takes the site down with it. The valid until date in an SSL Checker result tells you this immediately, and it is worth checking on a schedule rather than waiting for a visitor to report a warning.

A certificate is only valid for the exact names listed in it. A certificate issued for www.example.com will not automatically satisfy a visitor going to example.com without the www, or to a different subdomain like shop.example.com, unless that name was explicitly included as a subject alternative name, or covered by a wildcard entry such as *.example.com. This is a frequent problem after a site adds a new subdomain and simply forgets that the certificate needs updating to match.

As covered in reading a certificate, a server needs to send its own certificate along with any intermediate certificates that connect it back to a trusted root. When a server is configured to send only its own certificate, some browsers that already have the missing intermediate cached elsewhere will still work fine, which can make the problem look intermittent or device specific when it is actually a straightforward server misconfiguration.

If a certificate was generated locally rather than issued by a recognised authority, no browser anywhere will trust it without the visitor manually accepting an exception first. This is fine for internal or development use, but it means the certificate is not, and never will be, appropriate for a public site.

Certificate validity is checked against the time on the device viewing the site, not the server. A phone or computer with its clock set noticeably wrong, whether too far in the past or too far in the future, can reject an otherwise perfectly valid certificate as expired or not yet valid. This is rare but worth ruling out if a certificate checks out fine everywhere except on one specific device.

1. Run the domain through the SSL Checker and read the exact error and the days remaining figure first.
2. If it says expired, check the automated renewal process, it has most likely silently stopped running.
3. If it says the hostname does not match, confirm every subdomain in use is actually listed in the certificate's SAN entries.
4. If the chain status is unknown rather than trusted, check the server is sending its intermediate certificates alongside its own.
5. If everything above checks out and only one visitor reports an issue, ask them to check their device's clock.