Guide
How SSL expiry breaks a website overnight
A certificate that lapses at midnight can turn a healthy site into a full-page security warning by morning.
Published · Updated
Every HTTPS website relies on an SSL/TLS certificate that proves the site is who it claims to be. That certificate has a fixed expiry date. The moment it lapses, browsers stop trusting the connection and show a full-page security warning — “Your connection is not private” — instead of the site. Nothing about the content changed; visitors simply can't get past the warning. Because certificates expire at a precise timestamp, a site that was perfectly healthy at 11pm can be effectively offline by midnight. The fix is renewal — and the real fix is watching the expiry date so it never surprises you.
Why an expired certificate stops everything
On every HTTPS connection, the browser validates the site's certificate before showing a single pixel: is it signed by a trusted authority, does the name match the domain, and is the current time inside its validity window? Fail any one of those and the browser blocks the page with an interstitial warning that most visitors will never click through — assuming they even can, since many browsers make it deliberately hard.
Crucially, this is not a “degraded” state. It is a hard stop. The page does not load slowly or partially; it is replaced entirely by the warning. To a visitor, an expired certificate is indistinguishable from the site being down.
Why it happens “overnight”
A certificate is valid until an exact date and time, and modern certificates are short-lived — Let's Encrypt certificates last 90 days, and the industry maximum is now 200 days (dropping further in coming years). Automated renewal (tools like certbot and the ACME protocol) usually handles this quietly in the background.
The trouble is that automation fails silently. A renewal cron job that stopped running, a validation challenge that broke after a DNS change, a domain that moved hosts, or a manual certificate that nobody remembered to renew — none of these announce themselves. Everything keeps working right up until the clock passes the expiry timestamp, which is why the outage seems to arrive out of nowhere, often in the middle of the night.
What breaks, exactly
- Your website — visitors get a security interstitial instead of the page.
- APIs and integrations — TLS handshakes fail, so webhooks, mobile apps, and partner services stop connecting.
- Other services on the domain — mail and anything else using the same certificate can fail at the same instant.
- Search and trust — crawlers can't fetch the site, and visitors who do see the warning rarely come back.
How to stay ahead of it
- Automate renewal — then verify it runs. ACME/
certbotis the right default, but confirm the renewal job actually executed recently rather than assuming it did. - Renew with a buffer. Aim to renew when roughly 30 days remain, so a single failed attempt still leaves plenty of time to fix it.
- Watch the certificate, not just the homepage. A site can return a healthy 200 today and still be days from a certificate that expires. Track days-to-expiry and get an alert well before the deadline, not after.