Fix an expired or mismatched SSL certificate

1. Run the SSL checker for the exact hostname visitors use. The apex domain and www can have different certificates or servers.
2. If verification succeeds, review expiration and covered names. A certificate nearing expiry may need renewal attention even while it still works.
3. If verification fails, check the hosting control panel for expiry, hostname coverage and the intermediate chain. Use your certificate provider’s installation instructions; keep private keys private.
4. Check A and AAAA records. A stale IPv6 address or an old load-balanced server can serve the wrong certificate to some visitors.
5. Review automatic renewal and CAA records if issuance fails. Confirm your provider’s validation requirements, then check again after the repair.

This checker verifies trust and hostname for one public HTTPS endpoint on port 443. It does not send an HTTP request, scan ports, check revocation or grade every TLS setting. A failed check may also reflect a network block or timeout.

Website HTTPS success says nothing about SMTP STARTTLS on a mail server. Use your mail provider’s diagnostics for that separate service. Do not disable certificate validation to hide an error.

Reference: certificate verification.