A client calls to say their browser shows "Not secure" next to your website address, or a full-page warning saying "Your connection is not private" before they can get in. Most people close the page when they see that message, and those who carry on won't type in their card details. In most cases the problem is a small setting in the certificate or on the site.
What is an SSL certificate?
An SSL certificate, more accurately called TLS today, is a digital file on the server that proves the site belongs to the domain and lets the browser and server encrypt what passes between them. When the certificate is working, the address starts with https.
Without one, passwords, form data and customer messages travel as readable text that someone can intercept, on public Wi-Fi for example. That is why browsers treat any page without https as not secure, and Google counts it as a negative signal in search.
What is the difference between certificate types?
They differ in how much checking is done on the site owner's identity. The encryption strength is identical.
| Type | What gets verified | Best for |
|---|---|---|
| DV | Only that you control the domain. Issued within minutes, and includes free certificates such as Let's Encrypt. | Most websites and small stores. |
| OV | The domain and the company's legal existence, with a document review. | Organizations that want the company name shown in the certificate details. |
| EV | Extended verification of the company. | Banks and financial institutions. Modern browsers no longer show the company name next to the address the way they used to. |
Why does my website show a "Not secure" warning?
There are two kinds of warning. The small "Not secure" label next to the address usually means the page runs over http or loads content from it. A full page that blocks you from entering means there is a problem with the certificate itself.
These are the causes we see most often:
- The certificate has expired because automatic renewal stopped and nobody noticed.
- The certificate doesn't cover the name being requested. It covers example.com and not www.example.com, or the other way around.
- There is no redirect from http to https, so anyone typing the address by hand lands on the unencrypted version.
- Mixed content: the page is on https, but an image, font or script on it loads over http. This is common after moving an old WordPress site.
To find the cause, click the icon next to the address in your browser and read the certificate details, including the expiry date and the names it covers. To find mixed content, open the developer tools (F12) and look at the warnings in the Console.
How does an SSL certificate renew?
On most modern hosting, free certificates renew automatically. In cPanel the AutoSSL tool does this, and on private servers a program such as Certbot runs it on a schedule.
Automatic renewal needs the certificate issuer to confirm that you control the domain, and it fails when something along the way changes. Common examples: the domain now points to a different server, Cloudflare was put in front of the site and the validation path changed, or a new subdomain was added that doesn't point to the server yet. The renewal failure notice then goes to a mailbox nobody reads, and the certificate expires.
- Certificate issuedAfter domain control is verified
- A few days before expiryThe tool requests a new certificate automatically
- Validation againFails if the domain's routing or DNS has changed
- New certificate installedWith no downtime for visitors
- MonitoringAn alert reaches a named person if any step fails
Why are certificate lifetimes getting shorter?
The body that sets the rules for certificates, the CA/Browser Forum, decided to cut the maximum lifetime in stages. Since March 15, 2026 the maximum has been 200 days. It drops to 100 days in March 2027, then to 47 days in March 2029.
Free certificates from Let's Encrypt were already shorter, and Let's Encrypt has announced its own plan to shorten them further. In practice, renewing a certificate by hand once a year is no longer an option. If you have a paid certificate that someone installs manually, talk to your provider about automating it now.
These dates may be adjusted by later decisions. The direction toward shorter lifetimes is settled, so rely on automatic renewal and monitoring instead of a calendar reminder.
What is the right certificate setup for a company website?
- A certificate that covers the domain with and without www, plus every subdomain in use, such as mail or shop.
- A permanent (301) redirect from http to https, and from one form of the address to the other.
- Automatic renewal, with outside monitoring that sends an alert days before expiry.
- An alerts mailbox that a real person reads.
- If you use Cloudflare, set encryption to Full (strict). We explain why in Cloudflare and content delivery networks.
A certificate is part of the minimum security we ask about in how to choose hosting for your company website. We monitor and renew certificates for our clients' websites as part of our hosting and server service. If your site is showing a warning right now, send us the link and we will tell you the cause and how to fix it.
Questions our partners ask
Is a free certificate less secure than a paid one?
The encryption is the same. The difference is in how thoroughly the organization's identity is verified, and in support and warranties. For most brochure sites and small stores, a free certificate that renews automatically is enough.
How long is an SSL certificate valid?
The CA/Browser Forum is shortening the maximum lifetime in stages: 200 days since March 2026, then 100 days in 2027, down to 47 days in 2029. That makes automatic renewal a necessity.
Why does my site say "Not secure" even though I have a certificate?
Usually because the page loads an image or file over http, because the visitor opened the address without https and there is no automatic redirect, or because the certificate doesn't cover www or has expired.
Written by the Visual Innovate team, the people who build, host and follow up systems, websites and apps for our clients in Jordan, Saudi Arabia, Oman and Egypt.
