Your HTTPS certificate

When a certificate expires, every visitor gets a full-page browser warning saying the site is unsafe. Most leave. It is a total outage, and it happens on a schedule you can see in advance.

Automatic renewal handles this on every modern host — and it fails silently often enough that being told at fourteen days is worth something. The usual cause is a DNS record that changed, so the host can no longer prove it controls the domain.

On Vercel, Netlify, Cloudflare Pages, or Render: check your DNS records point at them, then remove and re-add the domain to force a fresh certificate. Renewal is automatic, so an expiry almost always means the domain verification broke.

On your own server: run your ACME client (Certbot or Caddy) and then check that its renewal timer is actually enabled — systemctl list-timers will tell you.

Require TLS 1.2 as a minimum and enable TLS 1.3. Add the Strict-Transport-Security header so browsers refuse to fall back to http. And if you use both the apex domain and www, make sure the certificate covers both — a mismatch produces the same warning page as an expiry.