What Happens When a Certificate Expires
An SSL/TLS certificate proves that traffic between the browser and your site is encrypted and that the site is who it claims to be. Certificates have a fixed expiry date. The moment that date passes, browsers stop trusting the certificate: Chrome shows the NET::ERR_CERT_DATE_INVALID error and a full-screen warning that actively discourages the visitor from continuing.
For your ads this is a total outage. The visitor does not see a slow or ugly page. They see no page. Most people leave immediately when confronted with a security warning, and honestly, on an unfamiliar store that is exactly what they should do.
Days is the lifetime of Let's Encrypt certificates used by a huge share of the web. Renewal must happen automatically, again and again.
Why Renewals Fail Silently
Let's Encrypt deliberately issues certificates for only 90 days to force websites to automate renewal. Automation is the right idea, but it creates a false sense of security: when a renewal fails once, nobody notices, because the site keeps working. The old certificate is still valid. The failure only becomes visible weeks later when it finally runs out, typically at night or on a weekend.
Typical causes of a silent renewal failure:
- A server configuration change: the renewal process needed a port or directory that another service has since taken over.
- A DNS change or site migration: the domain no longer points where the renewal runs.
- An expired payment card on paid certificates, or a cancelled account with the provider.
- The renewal job simply stopped running and nobody was notified.
Meanwhile, Your Ads Keep Running
Meta reviews ads at approval time, not continuously while they run. An expired certificate on your side does nothing to stop ad delivery or budget spend. Clicks keep getting billed; only your conversions drop to zero. If you pay €0.50 per click and the campaign drives 100 clicks a day, every day of the outage costs €50 with zero chance of return.
How to Protect Yourself
- Find out when your certificate expires. Click the padlock icon in your browser and check the certificate validity. It takes ten seconds.
-
Verify that automatic renewal actually works. It is not enough that it was set up once. Ask whoever runs your site for a renewal test run (with certbot, for example,
certbot renew --dry-run). - Monitor your ad landing pages including SSL. 404Watcher checks for SSL errors on every hourly run, so you know about an expired certificate within an hour, not after the weekend when it shows up in your stats.
Key Takeaways
- An expired certificate means visitors from your ads see a security warning instead of your page. Conversions drop to zero instantly.
- Automatic renewal failures are silent and only surface weeks later when the old certificate runs out.
- Meta will not pause your ads over an SSL error. The only protection is knowing about the problem before you pay for it.