The One Outage You Can See Coming: SSL and Domain Expiry

Almost every outage I get called about is a surprise. A host hiccups, a plugin update goes sideways, traffic spikes at the worst possible moment. Nobody saw it coming, because there was nothing to see. Then there is one failure that does the opposite. It tells you the exact date it will happen, sometimes months ahead, and businesses still walk straight into it.

That failure is an expired SSL certificate or an expired domain name. Both have a hard deadline printed on them from the day they are set up. Both will take your site down on schedule if nobody acts. And both are completely preventable, which is exactly why it stings to watch one happen.

What actually happens when a certificate expires

Your SSL certificate is the thing that puts the little padlock next to your address and turns on the "s" in https. It quietly proves to a visitor's browser that your site is really your site. Certificates are not permanent. They are issued for a fixed window, often ninety days or a year, and they have an expiry date baked in.

When that date passes without a renewal, nothing about your site changes on your end. The pages are all still there. But every modern browser stops trusting the connection and throws a full-screen red warning that says the site is not secure, with a scary "your connection is not private" headline. Most visitors never click past that screen. As far as your customers are concerned, you are down, even though the server is running perfectly. It is the worst kind of outage, the one where the building is fine but the front door is chained shut with a warning sign on it.

Domain expiry is the same problem with the volume turned up

A domain name is the address itself, the thing people type to reach you. You do not own it forever either. You rent it, usually a year at a time, from a registrar. Let that lapse and the consequences are worse than a certificate, because the domain does not just stop pointing at your site. Your email that runs on that domain stops too. Invoices bounce, customer replies vanish, and the login you need to fix it is often tied to the same dead address.

There is also a window after expiry where someone else can grab the name, and getting it back can turn into an expensive negotiation or a lost asset. A lapsed certificate is a bad afternoon. A lapsed domain can be a genuine emergency.

So why does this still happen to careful people

The obvious question is why anyone lets a dated deadline sneak up on them. I have seen it happen to organized, competent businesses, and the reason is almost never carelessness. It is that the reminders go to the wrong place or assume something that is no longer true.

• Auto-renew was on, but the card was not. Most registrars and certificate services do offer auto-renew. It quietly fails the day the card on file expires or hits a limit. The renewal does not happen, and the only warning is an email that nobody is watching for.
• The reminders go to an inbox nobody reads. Domains are often registered to whoever set the site up years ago, a former employee, an agency you no longer use, or a personal address that has since drowned in spam. The warnings are being sent. They are just landing somewhere with no eyes on it.
• The certificate and the domain live in different places. Your domain might be at one company, your hosting at another, your certificate issued by a third. Renewing one does nothing for the others, and no single dashboard shows you all three deadlines in one view.
• Auto-renewal broke and stayed quiet. Plenty of certificates renew automatically through the host. When that automation breaks, it breaks the way automations usually break, without a sound. Everything looks fine until the day it does not.

None of these are exotic. They are the normal, boring ways a deadline slips through a busy small business, and they all share one trait: the expiry was knowable the whole time, and nobody was checking the date itself.

The fix is almost embarrassingly simple

This is the rare problem where the solution is genuinely easy, because the thing you are watching is a date, not a moving target. You do not need to predict anything. You just need something that knows your expiry dates and warns a real person well before they arrive.

A proper check reads the certificate and the domain directly, the same way a browser does, and counts down. When you cross thirty days out, it tells you. Fourteen days out, it tells you again, louder. Seven days out it should be hard to ignore. The point is that the warning lands somewhere a human will actually see it, like a phone or a shared inbox the business checks every day, not an address from three setups ago.

This is the same idea behind everything else I have written about what monitoring actually does. Do not assume the system will renew itself and tell you if it fails. Check the result from the outside, on a schedule, and make the alert go where someone is looking. A certificate expiry caught at thirty days is a two-minute task. The same expiry caught by a customer screenshotting your security warning is a bad day plus a dent in trust you did not need to take.

The five-minute version you can do today

If you do nothing else, find out three things and write them on a calendar. What date does your domain expire, what date does your SSL certificate expire, and which email address gets the renewal notices. If you cannot answer all three, that gap is exactly where the outage lives. Most businesses I talk to can name maybe one of the three off the top of their head, and the missing two are the ones that bite.

From there, the durable fix is to stop relying on memory and a calendar reminder you might snooze. Put a watch on the dates themselves so the reminder comes from outside your own to-do list. It is the cheapest insurance in this whole field, because unlike most outages, you are paying to prevent something you can see coming from a mile away.