What Happens When Your SSL Certificate Expires?
When an SSL certificate expires, every visitor is blocked by a full-screen browser warning, and 80-95% of them bounce rather than click through. The costs stack up: direct lost revenue (proportional to your traffic and downtime), a lasting trust hit, a multi-week SEO footprint as crawl frequency drops, compliance findings under frameworks like PCI-DSS and SOC 2, and an engineering fire drill. It is one of the most preventable outages there is, because an expiring certificate announces itself weeks ahead if something is watching.
An expired SSL certificate doesn't quietly fail. Every visitor to your site sees a full-screen browser warning. New customers don't sign up. Existing customers lose trust. Search engines notice. The cost is real and adds up faster than most teams expect.
Here's exactly what happens, in order, when an SSL certificate expires - and what each consequence costs you.
What visitors see (within seconds)
The browser blocks the site with a full-screen interrupt. The exact wording differs by browser, but the message is always some variant of "this connection is not safe." The visual treatment is designed to be alarming:
- Chrome shows a red shield and the headline "Your connection is not private." The default action button says "Back to safety." The option to continue is buried as a small link.
- Firefox shows a triangle-with-exclamation-mark and "Warning: Potential Security Risk Ahead."
- Safari shows a similar warning with "This Connection Is Not Private."
- Edge and Brave follow the same pattern.
On mobile, the warnings are full-screen with even less ability to dismiss them. Some mobile browsers don't surface a "proceed anyway" option for certificate errors at all.
What visitors do (within seconds)
Almost nobody clicks through. Multiple studies of warning interactions over the past decade show bounce rates on certificate warning pages of 80–95%. The decision is fast - most users see the warning, close the tab, and search for an alternative.
New visitors bounce hardest. They have no brand attachment to overcome the warning. Their first impression of your site is "this site is not safe." Some never come back.
What it costs in lost revenue
Direct revenue loss is the easiest number to calculate. Take your monthly revenue, divide by total minutes in a month, multiply by the minutes you were down:
- A SaaS doing $50,000/month loses about $1.15 per minute of outage.
- An e-commerce site doing $5 million/month loses $115 per minute.
- A public company at scale loses much more.
For a multi-hour outage, the direct revenue loss alone is a five-to-six-figure event for most organisations. That's before the second-order costs.
What it costs in trust
The trust cost is harder to measure and probably larger than the direct revenue loss. A new visitor who sees "this connection is not private" doesn't think "their certificate expired" - they think "this site is not safe." That impression survives the fix. The next time they're considering you against a competitor, the small voice in the back of their head says "weren't they the ones with the security warning?"
Trust signals are asymmetric. A single security warning weighs heavily against many positive interactions. Certificate warnings are exactly this kind of signal.
What it costs in SEO
Google notices when sites serve errors. A short SSL outage can leave a multi-week footprint in search rankings:
- Crawl frequency drops. Googlebot reduces how often it crawls a site that returned errors.
- Indexed pages get demoted. Pages that returned errors during the last crawl can lose ranking until the next successful crawl.
- Bounce signals accumulate. Users bouncing from warning pages is a negative ranking signal.
A few hours of certificate failure can mean weeks of recovery in search visibility.
What it costs in compliance
If your organisation is under PCI-DSS, HIPAA, SOC 2, ISO 27001, or any other audit framework, an outage caused by an expired certificate is a particularly bad finding to explain. Auditors don't fault you for technical sophistication problems - they fault you for hygiene failures. "The certificate expired and we didn't notice" is the textbook example of a hygiene failure.
What it costs in engineering time
Every certificate outage is a fire drill. Two or three engineers stop what they're doing. Someone wakes up. A Slack incident channel gets created. A post-mortem gets written. A Jira ticket promises this will never happen again. Then, six months later, it happens again. None of that work ships features.
If your certificate just expired
Don't wait. Get a working certificate back in place as fast as possible:
Need a working certificate right now?
Beacon issues free 90-day Let's Encrypt certificates with a guided DNS-validation flow. No account, no command-line tools, no ACME client to install - just a domain you control. Most people get a working certificate in under 10 minutes.
Get a free certificate from BeaconIf you're here to prevent this
The fix isn't more careful humans. It's structural: monitoring that catches the problem before users do, alerts that go to teams rather than individuals, and verification from outside your network (not just from the server's view of itself).
Stop this from happening again
TLS Radar continuously monitors every certificate across your domains and alerts you weeks before anything expires, and also catches the silent failure modes - chain breaks, weak ciphers, hostname mismatches, risky EKUs, and distrust events - that keep a site from opening in every browser. Built for solo developers monitoring a handful of sites and for enterprise teams managing thousands of certificates across multiple environments.
Related reading
Frequently asked questions
- What happens when an SSL certificate expires?
- The browser blocks the site with a full-screen warning - Chrome's 'Your connection is not private', Firefox's 'Potential Security Risk Ahead', Safari's 'This Connection Is Not Private' - and most visitors leave rather than click through. Beyond the immediate lost traffic, it costs revenue, trust, search ranking, compliance standing, and engineering time.
- Do visitors click through an expired certificate warning?
- Almost never. Studies of warning interactions show bounce rates of 80-95% on certificate-warning pages. New visitors bounce hardest because they have no brand loyalty to overcome the 'this site is not safe' impression, and some never return. On mobile, many browsers do not even offer a way to proceed.
- How much does an expired SSL certificate cost?
- Direct revenue loss scales with your traffic and downtime - roughly $1.15 per minute for a $50k/month SaaS and $115 per minute for a $5M/month store - so a multi-hour outage is a five-to-six-figure event for most organizations. On top of that come a lasting trust hit, weeks of SEO recovery, possible compliance findings, and the engineering time of the fire drill.
- Does an expired certificate hurt SEO?
- Yes, temporarily. Google crawls a site that returned errors less often, can demote pages that errored during the last crawl until the next successful one, and treats users bouncing from warning pages as a negative signal. A few hours of certificate failure can mean weeks of search-visibility recovery.
Get the next post in your inbox
TLS monitoring tips and product updates. No spam, unsubscribe anytime.