An SSL certificate is what puts the padlock in the browser bar and enables HTTPS on your website. Without it - or with an expired one - visitors see a full-page security warning telling them the site is not safe. Most will leave immediately.
SSL certificates do not last forever. Here is how to stay on top of renewals and what to do if things go wrong.
Why SSL Certificates Expire
SSL certificates have a built-in expiry date as a security feature. It forces periodic verification that the certificate holder still controls the domain, and limits the window of exposure if a certificate is ever compromised.
Currently, major certificate authorities issue SSL certificates with a maximum validity of 398 days (about 13 months). This means even a freshly issued certificate will expire within just over a year.
The consequence of expiry is immediate: browsers flag the site with an error page, HTTPS stops working, and any SEO benefit from HTTPS is at risk. Search engines may also lower rankings for sites that serve content over insecure connections.
Checking Your Certificate Expiry Date
In your browser: Click the padlock icon in the address bar of your site, then click "Connection is secure" and "Certificate is valid" to see the expiry date.
Using SSL Shopper: Go to sslshopper.com/ssl-checker.html, enter your domain, and get a full certificate report including the exact expiry date, issuer, and any chain issues.
In cPanel: Navigate to cPanel > SSL/TLS Status to see the expiry dates for all certificates on your account.
Set a calendar reminder at least 30 days before the expiry date to ensure you have plenty of time to act.
Auto-Renewal with AutoSSL in cPanel
If your hosting plan includes AutoSSL (which dotCanada hosting accounts do), your Let's Encrypt SSL certificate renews automatically. Let's Encrypt issues 90-day certificates, and cPanel's AutoSSL checks regularly and renews certificates that are within 30 days of expiry.
To verify AutoSSL is working on your account:
- Log in to cPanel
- Navigate to SSL/TLS Status (under the Security section)
- Click Run AutoSSL to trigger a manual check
- Review the log to confirm your certificate is valid and renewal is not needed yet
If AutoSSL is failing, the log will show the reason - often a DNS misconfiguration or a domain that is not pointing to the server.
Manually Renewing a Paid Certificate
If you use a paid SSL certificate from a commercial certificate authority (CA) such as Sectigo, DigiCert, or GlobalSign, you need to initiate renewal manually through the CA or your hosting provider.
The process involves:
- Generating a new Certificate Signing Request (CSR) in cPanel under SSL/TLS Manager
- Submitting the CSR to your certificate authority to receive a new certificate
- Installing the new certificate in cPanel before the old one expires
Start this process at least two weeks before expiry to leave time for domain verification and any issues that arise.
What to Do If Your Certificate Has Already Expired
If your certificate has lapsed, the fix is the same as a renewal - just more urgent.
For Let's Encrypt (AutoSSL): Go to cPanel > SSL/TLS Status and run AutoSSL immediately. It will issue a new certificate within minutes if your domain is correctly pointed to the server.
For a paid certificate: Contact your CA or hosting support immediately. Some CAs offer a grace period where they can reissue the certificate for the remaining validity period at no extra charge.
Once the new certificate is installed, clear your browser cache and verify the padlock appears. If your site was temporarily served over HTTP, search engines will pick up HTTPS again on their next crawl.
Setting Calendar Reminders
The easiest way to avoid expiry is a recurring calendar reminder. For paid certificates with 12-month validity, set a reminder 45 days before expiry. For Let's Encrypt certificates managed by AutoSSL, a quarterly check-in to confirm AutoSSL is running successfully is a good habit.
With AutoSSL in cPanel, certificate maintenance largely takes care of itself - but it is still worth confirming the automation is running smoothly every few months rather than discovering a problem when a visitor reports an error.
