Your website says Not Secure and you have not noticed

Picture a small shop whose website has been showing a big red Not Secure warning for three weeks. Not down. Not hacked. Just a certificate that expired, and nobody inside the organization ever sees it because they all have the site bookmarked and the bookmark goes to the http version, which still loads fine. The owner finds out when a customer mentions it, or when the Google ranking drops, or when I send a screenshot.

That is the usual shape of the call. The site has been costing them traffic and trust for weeks, and the loss is invisible because there is no log entry for someone who saw the warning and left.

What an expired certificate actually costs

Browsers have gotten louder about this. Chrome shows a full-page interstitial. Firefox says the connection is not private and makes you click through two warnings to proceed. Mobile browsers are worse. A customer who does not know what a certificate is, which is most customers, sees what looks like a hacking warning and leaves. They do not call to report it. They go to a competitor.

The SEO cost is slower but just as real. Google has treated HTTPS as a ranking signal since 2014, and the current algorithm is not just checking for the presence of a certificate. It is checking that the certificate is valid. An expired cert gets treated like no cert, and no cert means you are ranked below competitors who have their infrastructure in order.

The trust cost is harder to measure but easy to feel. A shop that sells anything online, takes appointments, or handles any kind of customer data cannot afford to look like they do not know how to run a secure website. The warning does not say your certificate expired. It says this site is not secure, and that is what the customer remembers.

Why certificates now expire in 90 days

This used to be easier. Certificates were good for a year, then two years, then five. You bought one, installed it, and forgot about it until the registrar sent a renewal reminder. Then Let's Encrypt arrived in 2015 and made certificates free, and the industry started tightening the expiration window to force automation.

As of 2020, the maximum certificate lifetime is 398 days, and the major browsers are pushing it down to 90. Apple already treats anything longer than 398 days as invalid. The stated reason is security: a shorter lifetime means a compromised certificate is useful to an attacker for less time. The practical reason is that nobody can manually renew a certificate every 90 days without missing one, so the change forces the industry toward automation, which is more reliable than humans when it actually works.

The problem is that automation is another system to maintain, and on a self-managed host it is one more thing that breaks silently. Certbot runs as a cron job, fails because of a permissions change or an API rate limit or a DNS issue, and sends an error to an alias nobody reads. Ninety days later the certificate expires.

How managed hosting makes it a non-event

On the fleet I run, certificate issuance and renewal is not a task the client ever sees. It happens automatically on day one when the domain is added, renews at day sixty, and if the renewal fails the monitoring system alerts me, not the client. The client's first interaction with the certificate system is that their site has a lock icon and no warnings. The last interaction is the same.

That is not special technology. It is Let's Encrypt with monitoring that actually alerts on renewal failures, and a runbook for fixing them before they become outages. The difference between a managed host and a self-managed one is not the automation, it is who gets the alert when the automation breaks.

This is part of what the $49 hosting rate covers: infrastructure that renews itself, and a human who gets paged when it does not. A certificate expiring is not an emergency. A certificate expiring without anyone noticing for three weeks is a process failure, and process failures are what management is for.

If your site says Not Secure, the fix is fast. If you do not know whether it says that, go check it on a phone you do not usually use, from a network you are not usually on. Certificates expire on the calendar, but they get noticed when a customer bothers to mention it.