In this guide 6 sections
A site breaks when a certificate passes its end date, a domain is not renewed, or a DNS record changes. Browsers then show a security warning or no page at all. Most lapses trace to a renewal notice that reached a former employee or a registrar login nobody holds.
What visitors see when each thing fails
An expired certificate does not take the server down. The server still answers every request, but the browser refuses to trust the handshake and shows a full-page privacy error with a red padlock, so most visitors turn back.
A lapsed domain behaves differently. The name stops resolving. The browser says the server cannot be found, and mail to every address on that domain bounces because the MX records vanish with the registration.
A changed DNS record sits between the two. Some people see the site and others do not until resolver caches expire. Support calls start before anyone knows why.
- Certificate expired: browser warning, API calls fail with handshake errors
- Domain expired: name not found, email bounces
- Wrong DNS record: old server or no answer
- Certificate for the wrong name: warning on one subdomain only
The renewal email that went to someone who left
Registrars and certificate authorities send reminders to the contact on file. That contact is often the developer who bought the domain six years ago using a personal Gmail address, and the weekly warnings now land in an inbox nobody opens. Nobody sees the warning.
Check the contact on every domain and certificate you own. Use a shared mailbox such as domains@yourcompany, watched by two named people, instead of one person’s inbox that goes dark the day they resign.
A reminder only works if a living person reads it. Add the renewal dates to a shared calendar too, with two invitees. An expiring wildcard certificate then shows up beside the quarterly review, not inside a forgotten inbox.
Registrar logins that no one holds
The next failure is a login that nobody can use. The domain was bought through a web agency, a reseller or a founder’s private account. When renewal falls due no one can sign in, and recovery turns into days of identity checks.
List every domain with its registrar, account owner and the place the login is stored. Move registrations into an account owned by the company with a second administrator, then turn on registrar lock and multi-factor sign-in. Keep that list in a shared drive.
Turn on auto-renew. Also keep a card that has not expired, since auto-renew fails quietly when the card on file lapses.
- Registrar name and account email
- Expiry date of each domain
- Who holds multi-factor access
- Payment card and its expiry month
DNS changes that break a working site
A DNS record is a small edit with a large reach, and nobody reviews it the way they would review a code release. Someone moves hosting and updates the A record but forgets the AAAA record, so mobile visitors reach the new server while office staff land on the old one. Both sides report a different site.
Validation records are another trap. A CNAME that proves domain ownership gets deleted during a tidy-up, and automatic renewal through Let’s Encrypt or AWS Certificate Manager then fails at the next cycle. That is often weeks after the edit.
Keep DNS zone exports in Git. Every change shows who made it and when. Lower the TTL a day ahead of any planned edit.
How renewal monitoring catches each case
A monitoring check connects to the site from outside and reads the certificate’s notAfter date. Set alerts at thirty, fourteen and seven days, because a fourteen-day warning leaves room for a purchase approval and a validation step.
Add a domain expiry check that reads the registry record, and a DNS check that compares live answers with the expected A, MX and TXT values. Send each alert to a team channel and a shared mailbox, never to one person alone.
Test it once. Add the alert route to your on-call rota so that a seven-day warning gets a ticket and an owner, not just a message. Point a check at a staging site with a short-lived certificate and watch the alert arrive.
Renewal register
A one-page register with one row per domain and certificate. Columns hold the name, registrar or authority, account owner, contact mailbox and expiry date. Further columns show auto-renew status, validation method, alert dates at thirty, fourteen and seven days, and the person who acts.
Open a blank worksheet to printQuestions owners ask
Why did my site show a security warning though it was working yesterday?
The most likely cause is an expired certificate. Open the lock icon in the browser, read the valid-until date, then renew or fix the automatic renewal job that should have done it.
Can I recover a domain that has already expired?
Often yes, during a grace period set by the registry, though a redemption fee may apply. Contact the registrar at once, because after that period the name can be released to anyone.
Does automatic renewal remove the need for monitoring?
No. Automatic renewal fails when a validation record is deleted or a card expires. Monitoring from outside tells you the result a visitor sees, which is what matters.