Check who handles website certificate expiry

Before you start

• Identify the host or platform providing HTTPS for each public hostname.
• Keep any warning text and the time it first appeared.

What to do

1. Ask who owns renewal

   Check whether renewal is handled by your host, a managed supplier or a separate certificate arrangement. Ask where failure notices go and who acts on them. Do not rely on a calendar date copied from an old certificate if the platform regularly replaces it.

2. Separate the three renewals

   Domain registration, hosting subscriptions and certificates are different. Paying one does not prove the others are healthy. If an unexpected certificate invoice arrives, verify it inside the known provider account before deciding that a new payment is required.

3. Review changes that affect validation

   Tell the responsible maintainer about recent domain, DNS or hosting changes. Certificate issuance may depend on proving control of the domain through supported checks. Do not remove unfamiliar validation records or redirect rules as part of an unrelated tidy-up.

4. Verify recovery at the real address

   After a reported renewal or replacement, open each affected public hostname without bypassing warnings. Record whether the expected site loads securely. If a warning remains on only one device, include its date, time and browser details in the follow-up rather than assuming another certificate purchase is needed.

What to check

• Renewal alerts reach a monitored account.
• Both the main domain and relevant alternatives have been checked.
• The host has a way to detect failed automatic renewal.

Sources and further reading

Platform features can change. Check the provider’s current guidance before changing a live service.

• Let’s Encrypt: expiration-email changes
• Chrome: connection security