Fix guides

Renew your website's certificate

The certificate is what puts the padlock next to example.com in a browser. When it expires, every visitor gets a full-page security warning instead of your website, so this one is worth fixing the same day.

Who does this
Whoever hosts your website: the website builder, your web host, or your web developer.
How long
Usually minutes once you know who issues it. Longer if nobody does.
Fixes
  • The TLS certificate expired
  • The TLS certificate expires within 21 days
  • Could not read a TLS certificate from the domain on port 443

  1. Work out who issues the certificate

    Most website builders and many web hosts issue and renew certificates for you, automatically and at no charge. If you use one, the fix is theirs: contact their support and quote the finding from your report.

    If you bought a certificate yourself, or a developer set up your server, it is in your hosting control panel or with whoever you bought it from.

  2. If it was meant to renew automatically, find out why it didn't

    Automatic certificates (Let's Encrypt is the common one) last 90 days and renew themselves. Renewal usually fails for one of two reasons: the domain's DNS was changed so it no longer points at the host that issues the certificate, or the renewal job on the server stopped running.

    If you recently moved your website, changed DNS provider or put a service such as Cloudflare in front of the site, start there.

  3. Renew it and install the new one

    For an automatic certificate, your host's control panel normally has a button to reissue it. For a paid certificate, renew it with the seller, then install the new certificate on your host; the host's help pages will say how. The old certificate keeps showing until the new one is installed, so renewing alone is not enough.

  4. If there was no certificate to read at all

    Perimeter connects to example.com itself, without www, on the standard HTTPS port. Open https://example.com in a browser. If it fails but https://www.example.com works, the bare domain needs a certificate too, and usually a redirect to the www address. Most hosts can add the bare domain to the same certificate.

Check it worked

Open https://example.com in a browser and click the padlock: the certificate's expiry date should be in the future. Then re-run the checks from the business's report page.

Perimeter warns 21 days before a certificate expires, so an automatic renewal that has quietly stopped shows up here before your visitors see it.

The provider's own instructions

Menus move. If a step here doesn't match what you see, these pages are the source of truth.