SSL certificate errors: what they mean and how to fix them

• Most errors have one of four causes: an expired certificate, a certificate that does not cover the name you opened, a missing intermediate certificate or an issuer the browser does not trust.
• Free certificates such as Let's Encrypt are short-lived; automatic renewal is not optional.
• Since 15 March 2026 publicly trusted certificates can be valid for at most 200 days, falling to 100 days in 2027 and 47 days in 2029.
• Inspect the certificate with the SSL check and let Watch warn you before it expires.

Firefox shows the same problem as SEC_ERROR_EXPIRED_CERTIFICATE. Let's Encrypt certificates are valid for 90 days and are renewed automatically by an ACME client such as certbot or by your hosting panel. Renewal often fails silently: port 80 was closed, DNS was moved to another server, or the web server was never reloaded after the new certificate arrived.

CA/Browser Forum rules are shortening certificate lifetimes: at most 398 days until 15 March 2026, 200 days after that, 100 days from 15 March 2027 and 47 days from 15 March 2029. Manual renewal is no longer practical; automate it with ACME.

The server must send its own certificate together with the intermediate certificate(s). Desktop browsers can fill the gap from their cache, so the site “works on my computer” but fails on phones, in apps, in curl or in API clients. Install the full chain: fullchain.pem with Let's Encrypt, the “CA bundle” field in hosting panels. The SSL check shows whether the chain is complete.

The names a certificate covers are listed in its SAN (Subject Alternative Name) field; Firefox reports this error as SSL_ERROR_BAD_CERT_DOMAIN. A wildcard such as *.example.com covers exactly one level (shop.example.com), not example.com itself and not a.b.example.com. If the site also opens with www, the certificate must include both names.

• Mixed content: an HTTPS page loads scripts, images or styles over http://; the padlock disappears or the content is blocked. Change those addresses to https://.
• HSTS: once a site has sent HSTS, browsers do not let users click through certificate errors until max-age runs out. The fix is to repair the certificate, not to turn HTTPS off.
• CAA: if your domain has CAA records, only the CAs listed there may issue certificates; if yours is missing, renewal fails.
• A wrong clock on the device makes certificates look expired or not yet valid.
• Antivirus software and corporate proxies that inspect HTTPS present their own certificate; the error then appears only on that network or device.

• The SSL check shows the validity dates, covered names, chain, TLS versions, HSTS, the HTTP→HTTPS redirect and CAA records.
• Add the domain to Watch: you get an e-mail or Telegram alert before the certificate expires and when it becomes invalid.