What Can Go Wrong With an SSL Certificate
If your website does not have a valid SSL certificate, visitors will see a Not Secure warning in their browser before they even reach your homepage. Many will click away immediately. But SSL errors are not always obvious — an expired certificate can take your site offline without warning.
What is an SSL Certificate?
SSL (Secure Sockets Layer) certificates — more accurately called TLS certificates today — encrypt the connection between your website and your visitors. They are what make the padlock icon appear in the browser address bar and enable HTTPS instead of HTTP.
SSL certificates do three things: they encrypt data in transit, they verify your domain identity, and they signal to visitors (and Google) that your site is trustworthy.
Types of SSL Certificates
- DV (Domain Validation) — cheapest and most common. Only verifies you own the domain. Fine for most websites.
- OV (Organization Validation) — verifies the company behind the domain. Better for business sites.
- EV (Extended Validation) — the highest level. Used by banks and large e-commerce sites.
For most websites, a free DV certificate from Let's Encrypt is perfectly adequate.
Common SSL Errors and What They Mean
- Certificate Expired — your SSL cert has passed its expiry date. Browsers will block visitors until you renew it.
- Certificate Not Trusted — the certificate was not issued by a trusted Certificate Authority. Usually caused by a self-signed cert.
- Mixed Content — your page loads over HTTPS but some assets load over HTTP. Browsers will flag this.
- Hostname Mismatch — the certificate is for a different domain. Often happens when a cert for example.com is used on www.example.com without a wildcard.
How to Check Your SSL Certificate
PostureCheck checks your SSL certificate in seconds — whether it is valid, when it expires, who issued it, and which TLS protocol version your server supports. You can also check from the command line:
# Check SSL certificate details openssl s_client -connect yourdomain.com:443 -showcerts < /dev/null # Check expiry date echo | openssl s_client -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates
TLS Protocol Versions
PostureCheck also checks which TLS version your server uses. TLS 1.0 and 1.1 are now deprecated and insecure. Your server should be running TLS 1.2 at minimum, ideally TLS 1.3.
How to Fix SSL Issues
- Expired cert: renew through your hosting provider or re-issue a free Let's Encrypt certificate
- Self-signed cert: replace with one from a trusted CA — Let's Encrypt is free
- Hostname mismatch: get a wildcard certificate that covers both example.com and *.example.com
- Old TLS version: update your server config or ask your host to disable TLS 1.0/1.1
Most hosting platforms (Vercel, Netlify, Cloudflare, etc.) manage SSL certificates automatically. If you are on a traditional server, set up a cron job to auto-renew your Let's Encrypt certificate every 60 days.