Fix "Not Secure" / Expired SSL & Let's Encrypt Renewal

A "Not Secure" warning or certificate error means the browser doesn't trust your SSL — usually it expired, is mismatched, has renewal broken, or the page is mixing http and https content. Here is how to fix each.

Expired certificate

Let's Encrypt certs last 90 days and are meant to auto-renew. If yours expired, renewal stopped running. Force a renew and check the timer:

certbot renew --force-renewal
systemctl status certbot.timer   # is auto-renew active?

Why renewal fails

• HTTP-01 challenge blocked — port 80 must be reachable; the .well-known/acme-challenge path must serve files.
• DNS changed — the domain must still point to this server.
• Rate limited — too many failed attempts; wait before retrying.
• The cron/timer was removed — re-enable certbot.timer.

"Not Secure" but cert looks valid

Often mixed content — the page loads some resources over http://. Update those to https:// (or use a plugin/rule), and make sure the site redirects http to https. A cert for the wrong domain (www vs non-www) also triggers it.

Expired = renewal stopped (fix the timer + the ACME challenge). "Not secure" with a valid cert = mixed content or a domain mismatch.

Cause: wrong or missing intermediate certificate chain

Some setups install only the leaf certificate without the intermediate chain. Browsers may still show it as valid while some tools/APIs flag it as untrusted. Use an SSL checker to confirm the full chain is served, not just the certificate itself.

How to prevent SSL/renewal problems

• Use your panel's Let's Encrypt integration instead of a hand-rolled cron job where possible.
• Monitor certificate expiry with an uptime/SSL monitor so you find out before visitors do.
• Never block port 80 entirely if you rely on the HTTP-01 challenge.
• Keep DNS pointed correctly at your server at all times.

Related errors

A redirect loop after installing SSL usually means Cloudflare/WordPress settings disagree — see too many redirects. If the domain itself won't resolve, that's a DNS problem, not SSL — see pointing a domain (A record).