A customer opens your company’s website and, instead of the home page, sees a red warning: your connection is not private. Most visitors close the page right there. The cause is usually simple: the SSL certificate expired and nobody noticed. The same thing happens to mail servers, and staff Outlook and phones keep showing certificate errors.
What exactly does SSL do?
An SSL certificate, whose current technology is properly called TLS, does two things. First, it encrypts the connection between the browser and the server, so information such as passwords and form data can’t be read or tampered with in transit. Second, it verifies the site’s identity: a certificate authority (CA) has confirmed that this server really belongs to the domain. The result is an address that starts with https and that browsers open without a warning.
Certificate types
- DV (domain validation): Only control of the domain is checked. It is issued quickly and is enough for most websites. Free certificates such as Let’s Encrypt are this type.
- OV and EV (organization validation): The CA also verifies the company’s legal identity. Issuance takes longer and costs money, although modern browsers show little visible difference between these and DV.
- Wildcard: One certificate for all subdomains at one level; for example,
*.company.com. - Multi-domain (SAN): One certificate for several specific names, such as
company.com,www.company.comandmail.company.com.
Why automatic renewal is no longer optional
Certificate lifetimes have kept getting shorter in recent years. Let’s Encrypt certificates have always been short-lived, and the CA/Browser Forum, the body that sets certificate issuance rules, has approved a phased reduction in the maximum lifetime of all certificates. This means the once-common yearly manual renewal no longer works, and renewal has to be automatic.
On cPanel hosting, AutoSSL is usually enabled; it issues certificates for the account’s domains and subdomains and renews them before they expire. Check its status in the panel’s SSL/TLS section; the exact name of this section depends on the version and the host. On other servers, tools based on the ACME protocol, such as Certbot, do the same job.
Why automatic renewal sometimes fails
- The domain’s or subdomain’s A record points to another server, so the CA cannot verify control of the domain.
- The domain is behind a CDN or proxy, and the validation request doesn’t reach the server.
- A firewall rule or
.htaccessfile blocks access to the/.well-known/path. - A paid certificate was installed manually, and nobody remembers when it expires.
Common errors after installation
- Incomplete chain: The intermediate certificate isn’t installed; the site opens in a desktop browser but shows errors on some phones or apps.
- Mixed content: The page opens over https, but images or scripts still load over http.
- Wrong name: The certificate was issued for
company.com, but users openwww.company.comormail.company.com. - No redirect to https: The http version of the site is still reachable without an automatic redirect.
Monitor expiry before a customer tells you
Even with automatic renewal, monitor expiry dates. A monitoring service can check the certificates for your website, webmail and mail server every day and alert you when fewer than two weeks remain. For a manual check, just click the browser’s lock icon or run this command:
openssl s_client -connect company.com:443 -servername company.com | openssl x509 -noout -dates
Don’t look only at the website. Certificates for the mail server, admin panels, VPN and any service reachable from outside by domain name all have expiry dates.
Checklist
- Every reachable name, including www and mail, has a valid certificate.
- Automatic renewal is enabled and the last renewal succeeded.
- The certificate chain is complete, with no errors on mobile devices.
- All http addresses redirect to https.
- Certificate expiry dates are monitored automatically, with alerts.
ITPlus724 engineers can review the certificates for your company’s website, email and services, set up automatic renewal and keep their expiry under monitoring.