An expired certificate: the site was not hacked, but the customer already left

A site certificate lives for a limited time. While it is fine, the visitor does not see it. On the expiry day the browser shows a warning, some people close the tab, payment and the account area fall apart. That is not a breach. It is a calendar. For a store running ads it costs the same as downtime: the clicks are paid, the orders are not there.

Auto-renewal is often already on and still breaks. The account changed, a DNS record, a folder on the host, or the certificate was issued for an old name. A second address lives nearby, www or the account subdomain, with a different date. Staff get used to clicking through the warning on one of them, and that is already a bad habit toward a real substituted certificate.

What to keep on the calendar

• The date not only of the main name, but of the account area, mail and the test address if it is still needed.
• Who receives the mail from the issuer. A former employee's personal mailbox does not qualify.
• A check two weeks ahead, not on the morning the ads are already running.
• After renewal, open the site from a phone, not only from the office computer that forgave everything.

Lexora monitoring notices both downtime and a page that stopped being yours, but the certificate date should not be left "to whoever is on duty". In a monitoring contract this is a normal signal if the domain is on the list. On site maintenance, renewal is part of the work, not a heroic act. If the warning is already up, renew first, then see whether traffic left for a lookalike domain. The basic audit is free for new clients and includes a quick look at the dates of the names you list.