When the browser says the connection is not private, the site is effectively down. Most visitors turn back at the warning screen. The cause is usually easy to fix, and the code in the error message tells you directly which problem you have.
| Error | Cause | Fix |
|---|---|---|
| CERT_DATE_INVALID | The certificate has expired | Renew it. Automatic renewal has probably stopped working. |
| CERT_COMMON_NAME_INVALID | The certificate is for another address | The certificate is missing the www version, for example. Order one that covers both. |
| CERT_AUTHORITY_INVALID | The issuer is not recognised | The intermediate certificate is missing from the install, or the certificate is self signed. |
| No warning but no padlock | Mixed content | The page loads over HTTPS but an image or script comes over HTTP. |
Current free certificates are valid for 90 days and renew automatically. By the time a certificate is allowed to expire, renewal has already stopped working earlier. The usual causes are the domain being pointed somewhere else partway through and a redirect that blocks the renewal check. On Nordweb hosting the certificate renews automatically and needs no monitoring. Setting one up is described in the guide on taking an SSL certificate into use.
The most common form is a certificate that covers the address without the www prefix but not with it, or the other way round. A visitor who types the other form gets a warning. The fix is to order a certificate that covers both and to redirect one form permanently to the other, so the site has exactly one correct address.
If there is no warning but the padlock is missing, the page itself loads securely but part of it does not. The usual cause is an image, stylesheet or script whose address is still in http:// form, often left over from a migration or from switching to HTTPS. The console in the browser developer tools lists these by name. In WordPress it is worth fixing the addresses across the whole site in the database at once rather than editing them one at a time.
Once the certificate is in order, make sure http:// redirects permanently to https://. Without the redirect there are two versions of the site, which splits search visibility and leaves some visitors on an unencrypted connection.
We fix the certificate, the mixed content and the redirects in one go, so neither of them is left hanging. Fixing an SSL error is usually an hour of work.
