certificates

A certificate is a small, signed file that a browser checks before it trusts a website. It proves two things at once: that the site is genuinely the domain it claims to be, and that the connection can be encrypted using HTTPS. Without a valid certificate, a browser will not show the padlock, and depending on the browser, it may refuse to load the page at all.

Certificates are not permanent. They are issued for a fixed window, historically a year, now often much shorter, and then they expire. An expired certificate does not mean the site is insecure in some abstract sense. It means the proof has run out, and browsers treat that the same as a red flag, because in the past, expired certificates were a real sign of a site that had been abandoned or compromised.

Why it matters to you

An expired certificate is one of the most jarring failures a website can have. Instead of your homepage, a visitor sees a warning screen with red text telling them the connection is not private. Most people do not click through that. They leave, and they do not come back to check later. For a business relying on its site for quote requests or bookings, that is lost revenue with no notification that anything went wrong, unless someone happens to check the site itself.

How I set it up

Certificates on the sites I build are issued and renewed automatically by Cloudflare, as part of running the site behind Cloudflare’s network. There is no manual step, no calendar reminder, and no invoice to pay each year for a certificate specifically. It renews itself quietly, well ahead of the expiry date, using the same automated process every time. This sits alongside the other pieces of Cloudflare’s network that work the same way: traffic filtering, DNS, and DDoS protection, all running without anyone needing to log in and click renew.

This matters more than it sounds, because the older way of doing things, a certificate bought once a year from a separate vendor and installed by hand on a rented server, is exactly the kind of task that gets missed. Someone leaves, an invoice goes to an old inbox, and the certificate lapses without anyone noticing until a customer calls to say the site looks broken.

What it looks like in practice

Day to day, you see nothing. The padlock in the browser bar stays green, or whatever your browser’s equivalent is, and pages load the way they always have. If you go looking, most browsers let you click the padlock and see the certificate’s details: who issued it, and when it expires. On a site set up the way I build them, that expiry date will always be comfortably in the future, because the renewal happens automatically long before it gets close.