Domain Expired or SSL Certificate Expired? How to Tell
- domain expiration
A registered domain and a valid TLS certificate are two completely separate things, expiring on two completely separate schedules, but from the outside they can look like the same problem: a website that used to work stops working. Support inboxes get "the site is down" tickets for both, and the fix for one does nothing for the other. If you have ever renewed a certificate only to find out the real problem was the domain registration, or the other way around, this is the article for you. The short version: a domain expiring takes everything down, including email, because DNS itself stops answering. A certificate expiring leaves the site perfectly reachable but puts a full-page warning between every visitor and your content. Different failure, different owner, different fix.
What happens when a domain registration expires
A domain name is a lease, not a purchase. It is registered with a registrar for a fixed term, and if nobody renews it before that term runs out, the domain stops being yours in a very literal, technical sense: the DNS records that point your domain at your web server, your mail server, everything, stop resolving. Visitors do not see an error page from your own site, because there is no longer a route to your site at all - their browser gets a DNS failure before it ever reaches your server. Email breaks the same way, since mail delivery depends on the same DNS records (MX lookups) that web delivery does. If a domain has "expired" and you can still receive email on it, either it has not actually expired yet, or you are looking at the wrong domain.
Registrars do not delete an expired domain the instant it lapses. There is a recovery window, generally structured in stages: first a grace period where you can renew at the normal price, then a longer redemption period where the registry holds the name but charges a much higher restoration fee, then a final pending-delete window before the name is released back to the public, at which point anyone, including a domain investor watching for exactly this, can register it. The exact number of days at each stage, and the size of the redemption fee, varies by registry and by registrar, so treat any specific figure you read elsewhere as a rule of thumb for that particular case, not a universal constant. What is universal is the shape of it: the longer you wait, the more it costs to get the name back, and past a certain point it is simply gone. Recovering a lapsed domain is a registrar action - you, or whoever controls the registrar account, has to log in and renew or restore it. No amount of server or DNS configuration fixes it from your side.
What happens when a TLS certificate expires
A TLS (SSL) certificate is a much smaller, much shorter-lived commitment: a signed statement, valid for a limited period, that a particular public key belongs to your domain. DNS does not care about it, your hosting does not care about it, and your web server keeps serving pages exactly as before. What changes is what the visitor's browser does with those pages. The moment a certificate's expiry date passes, every browser that checks it, which is all of them, refuses to complete the secure connection and shows a full-page interstitial instead of your content: "Your connection is not private," a padlock with a warning triangle, or similar wording depending on the browser. The site is still there, the server is still up, but almost nobody will click through that warning to see it.
The fix is narrower than a domain recovery, too: reissue or renew the certificate and install the new one. For a certificate issued through an automated process, which most modern hosting and many certificate authorities support, renewal can happen unattended, on a schedule, with no human action required as long as the automation keeps running. That is the real risk with certificates in practice, not that renewal is hard, but that the automation quietly stopped (a cron job that stopped firing, a renewal hook that started failing) and nobody noticed until a visitor did.
How to tell which one you are looking at
| Symptom | Domain has expired | Certificate has expired |
|---|---|---|
| Does the site load at all | No - the browser fails to resolve the address before it ever reaches your server | The server responds, but the browser blocks the page behind a warning |
| What the browser shows | A "can't reach this site" / DNS error | A certificate or "connection is not private" warning |
| Email to that domain | Also breaks | Unaffected |
| Who can fix it | Whoever controls the registrar account | Whoever manages the certificate or hosting |
If you are not sure which one you are dealing with, do not guess - check each independently. A whois check tells you the domain's registration status directly. An SSL certificate check tells you the certificate's validity and expiry date directly. A quick DNS lookup confirms whether the domain is resolving at all, which by itself already separates the two cases: if it resolves, the domain is fine and any problem is downstream of it. Between these, you will know exactly which failure you are looking at before you touch anything.
How to monitor both so neither surprises you
The only real fix for either problem is to not find out about it from an angry visitor. HostTracker runs domain monitoring and certificate monitoring as two separate domain and TLS checks, each dedicated to watching one specific expiry, so you are not relying on remembering a renewal date yourself.
Both checks run on the same rhythm, roughly every 6 hours, since a registration or a certificate does not change status minute to minute. On top of whatever alert subscriptions you set for the check yourself, both checks also carry a reminder ladder that runs automatically: a heads-up sent 30 days, 7 days, and 1 day before the actual expiry date. This ladder is not something you configure, it just runs, and it goes out through message channels only, never a voice call. One detail worth knowing when you set contacts up: those advance reminders ride on the Up subscription for the check, so a contact needs to be subscribed to Up events, not only Down, to receive them. The actual Down alert, the one that fires because the domain or certificate has genuinely expired, is separate from the reminder ladder and only fires at the real expiry, never on one of the reminder days themselves. If it is still down after that, Repeat keeps notifying subscribed contacts until it recovers, at which point Up fires again.
Set each check up the way you would any other HostTracker monitor: point it at the domain or certificate you care about, add the contacts who should hear about it, and make sure at least one of them is on the Up subscription so the reminder ladder actually reaches someone. Full step-by-step walkthroughs are in the domain expiration guide and the certificate expiration guide.