Know which certificate visitors receive
An HTTPS certificate helps a browser establish an encrypted connection and confirm that it is connecting to a name covered by the certificate. A valid certificate is one part of a working HTTPS setup, not a guarantee that a website is otherwise secure. If a certificate expires or does not match the requested hostname, visitors may see a browser warning that prevents them from comfortably using the site.
Start by listing the addresses people actually use: for example, the main domain, a www version, a shop subdomain, or a separate booking site. Check each address in a browser and inspect its connection or certificate details. Confirm that the certificate covers the hostname and note its expiration date. Do not assume that a certificate covering one address also covers every subdomain.
If a content delivery network or hosting service sits in front of the website, the certificate shown to visitors may differ from the certificate used between that service and the origin server. Both connections matter, but they may have separate owners and renewal processes. Record which service manages each certificate so a future warning reaches the right person.
Find out how renewal is supposed to work
Many hosts manage certificate issuance and renewal for their customers. Other sites use an automated certificate client running on a server. Some organizations install certificates through a control panel or a more manual process. The first maintenance task is not to change any of these systems; it is to identify which one your site uses and where you can see its renewal status.
Write a short note for each certificate: the hostnames it covers, who manages it, where renewal settings live, and who receives failure notices. If you manage the server, include the name of the renewal service or scheduled task and the location of its logs. Keep account access details in an appropriate password manager rather than in the note itself. This small inventory is especially useful when a freelancer hands a site over to a client.
Check whether renewal updates the certificate that the web server actually serves. On some setups, a renewed certificate must be deployed to another system or the server must reload before visitors receive it. A success message from a renewal client is helpful, but checking the live site afterward confirms more.
Protect the steps renewal depends on
Automatic renewal usually depends on proving control of the domain. Depending on the setup, that may involve a reachable web address or a particular DNS record. Changes to DNS, hosting, firewall rules, redirects, or site routing can interrupt that check even while the existing website appears to work. If your renewal system offers a test run, use it after relevant infrastructure changes and investigate any errors it reports.
Avoid treating old configuration as disposable until you know its purpose. A DNS record used for validation, a path reserved for certificate checks, or access granted to a hosting integration may be part of the renewal process. Conversely, do not leave broad access in place merely because it might be needed. Document the dependency, then maintain only the permissions and records the chosen method requires.
Domain registration is another dependency worth tracking. If the domain expires or its DNS is moved unexpectedly, certificate renewal may not be your only problem. Keep the domain registrar account accessible to the responsible owner, review its contact information, and know who can approve changes.
Set up checks that leave time to respond
A calendar reminder to inspect certificates is better than relying on a browser warning from a visitor. For greater coverage, use a monitor that checks the public HTTPS endpoint and alerts you before its certificate expires. Check that it watches the hostnames people use, not just the server’s internal address. If a service manages both www and non-www versions, confirm both are included.
Send alerts to an inbox that is read regularly and assign a backup contact. Treat an alert as a prompt to investigate rather than proof of a particular cause: the problem might be failed validation, a deployment that did not finish, or a monitor checking the wrong endpoint. Keep a brief record of the fix so the next person has a starting point.
After a renewal or a major hosting change, visit the live HTTPS addresses again. Check for browser warnings, hostname mismatches, and an expiration date consistent with a renewed certificate. If the site uses a CDN, check its dashboard or documentation as well to confirm that its connection to the origin is configured as intended.
Make certificate checks part of ordinary maintenance
Certificate care works best as a repeatable task rather than an emergency procedure. Add the certificate inventory to your website handover notes. When you change a domain, host, CDN, DNS provider, or deployment workflow, include renewal in the change checklist. Test the public addresses once the change is complete, and make sure monitoring still points to the right place.
If renewal fails, resist the temptation to dismiss the browser warning or disable HTTPS as a quick fix. Read the renewal error, verify the domain and validation method, and check whether the renewed certificate was installed where visitors connect. If your host manages certificates, contact its support with the affected hostname and the warning you see. A clear owner, a working alert, and a short checklist can turn a surprising outage into a manageable maintenance task.
