Article image
What Happens When an SSL Certificate Expires? (And How Agencies Can Prevent It)
Few things trigger an all-hands-on-deck crisis for a digital agency faster than an influx of panicked client emails screaming that their websites are broken. You click the link, and there it is: a giant, ominous red warning page reading "Your connection is not private" or "Warning: Potential Security Risk Ahead." At that moment, the client's site traffic plummets to zero, their e-commerce sales grind to a halt, and your agency's reputation takes an immediate hit.
The culprit? An expired SSL certificate.
What used to be a simple, once-a-year maintenance task has evolved into a major operational headache for digital agencies, web developers, and IT service providers. With industry bodies radically shortening certificate lifespans — and a seismic regulatory shift already underway in 2026 — managing SSL health manually is no longer viable.
In this guide, we unpack exactly what happens behind the scenes when an SSL certificate expires, the catastrophic impact it has on your clients' businesses, and how modern agencies can use automated SSL tracking to eliminate this risk entirely.
What Is an SSL Certificate, and Why Does It Expire?
An SSL certificate (now technically implemented via its successor protocol, Transport Layer Security or TLS) fulfills two primary roles on the modern web.
Encryption is the first. It encrypts all data transmitted between a user's browser and the origin server, ensuring that sensitive information — login credentials, personal data, credit card numbers — cannot be intercepted by malicious actors.
Authentication is the second. The certificate acts as a digital passport, verified by a trusted third-party called a Certificate Authority (CA), which confirms to the browser that the website is genuine and not an imposter.
The Rapidly Shrinking Validity Window
Many agency owners ask: if the website hasn't changed, why must SSL certificates expire at all?
The answer lies in security compliance and identity verification. Security standards are governed by the CA/Browser Forum, a voluntary consortium of browser vendors and certificate authorities. Historically, certificates were valid for up to five years, then two years, then just 398 days.
We are now entering a period of even more dramatic compression. In April 2025, the CA/Browser Forum unanimously approved Ballot SC-081v3 — a measure originally proposed by Apple and endorsed immediately by all four major browser vendors: Apple, Google, Mozilla, and Microsoft. The ballot passed with 29 votes in favour and zero in opposition. It sets a phased schedule to reduce the maximum SSL/TLS certificate validity from 398 days down to just 47 days by March 2029.
The reduction happens in three hard-cutoff phases based on certificate issuance date:
Effective Date Maximum Certificate Validity
Up to March 14, 2026 398 days (current)
March 15, 2026 200 days
March 15, 2027 100 days
March 15, 2029 47 days
Note for agencies: The first phase is already in effect. As of March 15, 2026, any newly issued public SSL/TLS certificate has a maximum lifespan of 200 days. Annual renewal workflows are already broken. If your agency has not yet audited its certificate inventory and renewal pipelines, this is urgent.
The 47-day figure is deliberate. It is short enough to make manual renewal impractical at any meaningful scale, but long enough for automated systems to operate without excessive overhead. Compared to the current 398-day cycle, it represents an eightfold increase in renewal frequency.
There are two core reasons the industry is moving in this direction:
Cryptographic agility is the first. Shorter lifespans ensure that if a specific encryption algorithm becomes vulnerable, the global web can transition to stronger keys far faster than a 13-month window would allow. This is particularly relevant as the industry prepares for a post-quantum cryptography transition.
Accurate identity verification is the second. If a business closes, changes ownership, or abandons a domain, a shorter certificate lifecycle prevents an outdated entity from maintaining a trusted cryptographic identity indefinitely. The CA/Browser Forum noted that shorter lifespans decrease "the period of time in which inaccurate information would remain in a valid certificate, independent of any additional action by any involved stakeholder."
The DCV Reuse Problem Agencies Are Missing
Alongside validity period changes, the ballot also dramatically reduces the Domain Control Validation (DCV) reuse period — a change that is flying under the radar for many agencies.
DCV is the process by which a certificate authority verifies that you actually control the domain you are requesting a certificate for. Currently, this validation can be reused for 398 days. Under SC-081v3, that window drops to 10 days by March 2029. This means domain ownership must be re-verified with nearly every certificate issuance — eliminating the last viable semi-manual workflow.
What Happens When an SSL Certificate Expires?
When an SSL certificate reaches its expiration date, it does not simply stop encrypting data quietly. It triggers a chain reaction across browsers, search engines, API systems, and integrated services. Here is exactly what happens.
- Web Browsers Aggressively Block Access When a user navigates to your client's URL, their browser initiates an SSL/TLS handshake with the server. During this process, the certificate's validity dates are checked. If the clock has run out by even a single second, the Certificate Authority marks it as invalid, the browser aborts the handshake, and a full-screen security warning is served in place of the website.
Google Chrome displays "Your connection is not private." Apple Safari shows a certificate error page. Microsoft Edge and Mozilla Firefox produce similarly alarming warnings, complete with red padlock icons and prominent "Go Back" buttons.
Because this visual layout looks identical to a malware infection warning, the user abandonment rate is severe. Research from BigCommerce found that 85% of shoppers will abandon or avoid sites displaying security warnings. A separate study by WebsitePulse found that almost 90% of customers stop a transaction after receiving an SSL expiry warning. To the average consumer, an expired certificate is indistinguishable from a hacked website.
- Immediate Loss of Traffic, Conversions, and Revenue An expired SSL certificate has a direct and quantifiable impact on the bottom line of any client business.
For e-commerce sites, no user will enter their credit card details on a checkout page displaying "Insecure." For lead generation funnels, form submissions drop to near zero. If your agency is running paid Google Ads or Meta Ads campaigns to a landing page with an expired certificate, every click is a wasted ad budget spend that lands on a browser warning page instead of a converting page.
The financial scale of certificate-related downtime across the industry is significant. According to CyberArk's 2025 State of Machine Identity Security Report, 72% of organisations experienced at least one certificate-related outage in the past year, with 34% suffering multiple outages. Industry research cited by CyberArk estimates that the average organisation experiences three certificate-related outages per year, each lasting around four hours and costing approximately $9,000 per minute — a figure that varies by company size and sector. Separately, certificate-related downtime is estimated to cost enterprises an average of $5.6 million when factoring in remediation, reputation damage, and lost revenue.
- SEO Rankings and Search Visibility Are Damaged Google has used HTTPS as a ranking signal since 2014. When search engine crawlers encounter a site with an expired SSL certificate, the site is flagged as unsafe and signals a poor user experience. The consequences of a lapsed certificate compound rapidly:
The immediate surge in bounce rate (users leaving the browser warning page in seconds) sends a powerful negative user experience signal to Google's ranking algorithms. If the certificate remains expired for more than a few days, de-indexing risks emerge as crawlers deprioritise the site. Even after renewing the certificate, it can take days or weeks for organic rankings to recover to their pre-expiration levels.
- APIs, Payment Gateways, and Integrations Break Silently Modern websites are rarely isolated systems. They rely heavily on machine-to-machine communication, and an expired SSL certificate breaks these integrations immediately — often without sending any visible error to the end user.
Payment gateways such as Stripe, PayPal, and Authorize.net require secure endpoints. A lapsed certificate causes API handshakes to fail, completely blocking payment processing. Inbound webhooks sending leads from web forms into platforms like HubSpot or Salesforce will silently fail, causing irreplaceable lead data to be lost. If your client has a mobile application that fetches data from a web API endpoint your agency manages, that app will break or crash for all users — often without any obvious error message indicating the real cause.
- Users Are Exposed to Real Security Vulnerabilities If a user does bypass a browser warning (a small but non-zero percentage will), their connection frequently degrades to unencrypted HTTP. This leaves them genuinely exposed. Man-in-the-middle (MITM) attacks become possible, where an attacker positioned between the user and the server can intercept, read, or alter the data being transmitted. Session hijacking becomes a viable vector, where attackers harvest session tokens to impersonate legitimate users and potentially compromise administrator dashboards.
The problem is not merely theoretical. In 2018, Ericsson — a company handling approximately 40% of global mobile traffic — experienced a catastrophic outage due to an expired SSL certificate. The impact affected 32 million customers across 11 countries, caused a nationwide failure of the O2 mobile network in the UK, and ultimately cost the company an estimated $1.4 billion in remediation costs, legal settlements, and fines. The root cause was a single expired certificate.
Why Manual SSL Tracking Is No Longer Viable
Many agencies still manage their client portfolios using spreadsheets, calendar reminders, or vague reliance on hosting platform auto-renewals. As the industry accelerates toward 47-day certificate cycles, these approaches are not merely inconvenient — they are a direct path to client outages.
The Problem With Spreadsheet Tracking
Maintaining an Excel or Google Sheet listing client domains, CAs, and expiration dates seems workable when you have five clients. It breaks down at scale. Spreadsheets are static, dependent on human input, and contain no awareness of the live state of a certificate. If a client migrates their site without informing your agency, or if an account manager forgets to update a row after an emergency DNS change, the document becomes silently inaccurate — often only discovered when a certificate has already expired.
The Illusion of Set-and-Forget Auto-Renewal
Many hosting platforms offer free Let's Encrypt certificates with automatic renewal via the ACME protocol. These are genuinely useful, but relying on them blindly is risky. Auto-renewals fail for several reasons that are common in agency environments:
DNS misconfigurations are a frequent culprit. If a client alters their Cloudflare, GoDaddy, or Route 53 records without notifying your agency, the ACME domain validation challenge will fail silently, breaking the auto-renewal loop. Server firewall updates can unexpectedly block the inbound IP ranges used by certificate authorities to verify domain ownership. Plugin and CMS conflicts — particularly in WordPress environments — can accidentally block the file paths required for HTTP-01 renewal challenges.
Crucially, when these background failures occur, hosting platforms rarely send an external notification to your agency's support desk. The first signal is typically an angry client call.
The Operational Maths of 47-Day Certificates
The scale of the coming challenge is worth quantifying directly. It takes approximately four hours to manage a single certificate manually through its full renewal lifecycle. An agency managing 100 client sites currently handles roughly 100 renewal events per year under a 398-day model.
Under 47-day certificates, those same 100 sites generate approximately 800 renewal events per year — an eightfold increase in workload. At four hours per certificate, that is 3,200 hours of manual SSL management annually. This is not a process that can be absorbed into existing workflows. It requires automation.
According to CSC's 2025 research analysing over 100,000 global SSL certificate records, 40% of enterprises are already at risk of unexpected service outages caused by out-of-date SSL certificates. A separate study found that 48% of organisations still rely on manual tracking methods despite the accelerating pace of certificate change.
How Agencies Can Prevent SSL Expiration
The only viable answer to this accelerating operational pressure is a shift from reactive emergency response to proactive, automated monitoring.
Centralise Your Domain Inventory
You cannot protect what you cannot see. Begin with a full audit of every public-facing endpoint across your client portfolio — root domains, subdomains, client portals, staging environments, and any API endpoints your agency manages. This inventory must be a living document, updated automatically rather than maintained by hand.
Experienced practitioners at SSLInsights have noted: "The single biggest risk is certificate discovery gaps — certificates that were forgotten, never inventoried, and will expire silently. Start your certificate audit before you evaluate any automation tool."
Implement Multi-Channel Threshold Alerts
A single email notification is insufficient. Email inboxes miss critical alerts, notifications end up in spam, and on-call engineers may not be watching their email at 2 AM when a certificate expires. Effective alert strategies use tiered, multi-channel notifications at structured intervals — typically 30 days, 14 days, 7 days, and 48 hours before expiration — routed across:
Slack or Microsoft Teams integrations for immediate internal visibility within production channels, and SMS or voice alerts reserved for high-priority escalations when a certificate is within 48 hours of expiration.
Deploy Continuous External Monitoring
Do not rely on server-side scripts to self-report certificate health. Internal monitoring cannot detect all failure modes — for example, a broken intermediate certificate chain or a CDN caching failure that causes a valid certificate to appear expired from certain geographic regions. Use external monitoring tools that simulate real user handshakes from multiple global nodes. This provides ground-truth visibility into what your clients' end users are actually experiencing.
Adopt Full Certificate Lifecycle Automation
The CA/Browser Forum's own position is unambiguous: the phased reduction to 47-day certificates is explicitly designed to make manual management impractical and drive the industry toward automated Certificate Lifecycle Management (CLM). The Forum has stated that manual revalidation will remain "technically possible" under the 47-day model, but will be "a recipe for failure and outages."
For agencies, this means evaluating dedicated tools that handle discovery, monitoring, alerting, and renewal orchestration across a multi-client portfolio without requiring manual intervention for each renewal event.
A Forrester Consulting Total Economic Impact study conducted on behalf of Sectigo found that organisations automating certificate lifecycle management achieved a 243% return on investment, with reductions in provisioning labour totalling $1.3 million and reductions in renewal expenses totalling $965,000 over three years.
SSL Management Checklist for Agencies
Use this as a starting framework for your agency's SSL governance process.
Action Method Frequency
Audit active certificate inventory Map every root domain, subdomain, staging site, and client portal Monthly
Verify full certificate chains Check that intermediate chains are intact and free of browser errors Continuous
Test auto-renewal pipelines Confirm ACME validation scripts are clear of DNS errors and firewall blocks Every 30 days
Monitor from external nodes Simulate user handshakes from multiple geographic locations Continuous
Set multi-channel threshold alerts Configure alerts at 30, 14, 7, and 2 days before expiration Once, then review quarterly
Adopt automated CLM tooling Deploy a dedicated platform for discovery, monitoring, and renewal orchestration As soon as possible
The Bottom Line
SSL certificate management is undergoing its most significant structural change in the history of the public web. The CA/Browser Forum's unanimous approval of Ballot SC-081v3 in April 2025 — backed by Apple, Google, Mozilla, and Microsoft — has set in motion a phased reduction from 398-day certificates to 47-day certificates by March 2029. The first phase, capping certificates at 200 days, is already in effect as of March 15, 2026.
For digital agencies, the implication is clear. Managing SSL certificates manually — whether via spreadsheets, calendar reminders, or passive trust in hosting auto-renewals — is no longer a sustainable operating model. The agencies that will protect their clients, their MRR, and their reputations in this new environment are the ones that build automated, centralised certificate monitoring into their infrastructure now, well before the 100-day and 47-day deadlines arrive.
The cost of a single major client outage — in lost revenue, emergency engineering hours, damaged trust, and SEO recovery time — will far exceed the investment in proper automation. The industry has made its direction of travel explicit. The only question is how quickly your agency adapts.
Top comments (0)