Expired SSL certificates: the checkout outage with a date on it
A certificate outage is the only checkout failure you can predict to the minute. The expiry date is written in the certificate. And yet it keeps happening, usually because renewal was automatic — until one day it quietly was not.
Why automatic renewal fails
Renewal depends on things that change: DNS records moved to a new provider, a firewall or CDN rule that blocks the validation request, a server migration that left the renewal job behind, a payment card on the certificate account that expired.
None of these make noise when they break. The certificate keeps working until its last day, and the first sign is a full-page browser warning that no customer will click through.
It is not only the main domain
A checkout often depends on more than one certificate: the www and bare domain, a separate media or static host, an API subdomain used by the checkout, and the endpoint the payment provider calls back after payment.
If a callback endpoint’s certificate expires, the storefront still looks fine. Customers pay, the provider cannot confirm the payment to your store, and orders get stuck in “pending payment” instead of failing loudly.
What to watch
List every hostname involved in a purchase and check each certificate’s expiry on a schedule, with a warning weeks ahead, not days. Send that warning somewhere a person reads, not a mailbox nobody opens.
Keep a real checkout check running too. It catches the case a date check cannot: a certificate that is valid but misconfigured — wrong chain, wrong hostname — which some browsers and payment widgets refuse. Related: payment notifications on Magento and PayPal webhooks on WooCommerce.
Check your own store now, free: the WooCommerce checkout checker or the Magento checkout test walks the checkout in a real browser and shows the step where it stops.
Common questions
What happens to checkout when the SSL certificate expires?
Browsers show a security warning and most customers leave; payment providers refuse callbacks to the store.
Why does automatic certificate renewal fail?
DNS or redirects block the validation, a CDN serves its own certificate, or the renewal job fails silently.
How do I monitor certificate expiry?
Alert 14 to 30 days before expiry for every hostname the checkout uses, including static, media and API subdomains.