Diagnostics bench · Intermediate · 20 min
How to fix common SSL errors — SSL Errors: Read the Code, Then Query the Handshake
The browser has already told you which of four things is wrong — the next move is to confirm it from the wire rather than from another refresh.
The short answer
Read the exact error string first, because each one maps to a single fault with a single fix: expired means renewal stalled, name mismatch means the certificate does not cover the hostname typed, untrusted usually means an incomplete chain, and a padlock with a warning is not a certificate problem at all but mixed content.
Then confirm it from the handshake rather than the browser, because the browser caches, and a colleague's device may see something different from yours. openssl s_client -connect example.com:443 -servername example.com returns the dates, the names and the chain the server is actually presenting.
By the HostingFast team · Reviewed 24 August 2026
Intermediate
Assumed level
5
Stages to done
Free
Support cost
Proven
Verified on production
Twenty minutes, most of it spent reading output rather than changing configuration. Two commands do the diagnostic work; the fixes themselves are usually one setting.
AutoSSL issues and renews certificates on every plan here, so a certificate that has expired is nearly always a validation problem upstream of the certificate itself.
Four faults, four signatures
Expired: the certificate's notAfter date has passed, which on an automated platform means renewal was attempted and could not validate. Name mismatch: the certificate is valid but does not list the hostname the visitor typed — classically it covers example.com but not www.example.com, or the other way round. Untrusted: the certificate is fine but the server is not sending the intermediate that links it to a trusted root.
The fourth is the one most often misfiled as an SSL fault. A padlock with a warning, or a not-secure label on a page that loads over HTTPS, means some asset on the page is being requested over plain HTTP. The certificate is working perfectly; the page is the problem.
Query the handshake directly
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -ext subjectAltName gives you three answers at once: when it expires, whose name is on it, and every hostname it covers. The -servername flag matters, because without it you are asking for the server's default certificate rather than yours.
For the chain, run openssl s_client without piping and read the certificate chain block at the top of the output. If it shows only your certificate and no intermediate, you have found your untrusted error — and you have found it in a way that does not depend on which device happens to have the intermediate cached.
Why automatic issuance stalls
AutoSSL has to prove control of the name, which means the name must resolve to this server. The usual causes of a stalled renewal are therefore DNS, not TLS: an A record still pointing at a previous host, a subdomain that was removed from the zone, or a CAA record naming a certificate authority other than the one issuing here. Fix the pointing and renewal resumes on its own — there is nothing to reinstall.
Check the SSL status page in cPanel for which hostnames are covered and which failed, and check your zone for a CAA record before assuming the platform is at fault. A CAA record is a deliberate instruction to certificate authorities, and it is doing exactly what it was asked to do.
Mixed content is a content problem
Open the browser console and it will name every asset requested over HTTP. Typically it is hard-coded image URLs in old post content, a stylesheet referencing an http:// font, or a plugin with an absolute URL in its settings. The certificate cannot help; the references have to change.
The reliable fix is a database search-replace from http://example.com to https://example.com, done with a tool that handles serialised data properly — wp search-replace does, a raw SQL UPDATE does not. Then purge the cache and re-check the console, because the cached HTML still carries the old references until you do.
How certificates are handled on this platform
AutoSSL issues and renews a free certificate for every hostname that resolves here, including addon domains and subdomains, and the SSL status page in cPanel shows exactly which names are covered.
Every plan includes free SSL that renews itself before it can lapse; the paid wildcard and organisation-validated options exist for the specific cases that need them.
- Each browser error mapped to one fault and one fix
- Two openssl commands that answer it from the wire
- DNS causes named, because that is where renewals stall
- Support at any hour when a customer sees what you cannot
Why HostingFast
Standard on every plan
Error string as diagnosis
Four faults, four signatures, so the first minute narrows the problem instead of restating it.
Confirmed from the wire
openssl s_client with the flags that matter, so the answer does not depend on which browser you happen to have open.
Renewal traced upstream
Stalled AutoSSL is a DNS problem far more often than a certificate one, and the guide checks in that order.
CAA records covered
The record that silently blocks issuance gets named, because nothing in the certificate error will mention it.
Mixed content separated out
A warning padlock is a content fault with a TLS symptom, and it is fixed in the database rather than the certificate.
Serialisation-safe replacement
The search-replace advice specifies a tool that handles serialised data, so the fix does not break your options table.
Quick Start
From order to online
- 1
Copy the exact error string out of the browser
Not slow site or broken padlock — the code itself. Each maps to one fault, and guessing from a screenshot description costs more time than reading the certificate does.
- 2
Ask the server what it is presenting
openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -dates -subject -ext subjectAltName. Dates, subject and every covered hostname, in one command.
- 3
For expiry, check DNS before the certificate
AutoSSL cannot validate a name that does not resolve here. Look for a stale A record, a removed subdomain or a CAA record naming a different authority, then let renewal run again.
- 4
For untrusted, look at the chain, not the leaf
Read the certificate chain block in the s_client output. A missing intermediate passes on a desktop that has it cached and fails on a phone that does not, which is exactly the it works for me pattern.
- 5
For a warning padlock, hunt the http references
The browser console lists them. Fix with wp search-replace so serialised data survives, purge every cache layer, then reload the console and confirm it is empty.
Built In
Loaded onto every plan
- AutoSSL issuing and renewing free certificates for every resolving hostname
- An SSL status page in cPanel showing which names are covered
- Free SSL on every plan, renewed automatically before it can expire
- Wildcard and organisation-validated certificates available where you need them
- Full SSH access with WP-CLI for a serialisation-safe search-replace
- LiteSpeed caching in the server, with a purge control you own
- Per-site PHP version switching from the control panel
- Free migration by our engineers, with certificates reissued on arrival
- Money-back cover: 30 days on hosting plans, 7 on reseller
- Human support on duty every hour of every day
Frequently Asked
What people ask us most often
Why does the certificate work in my browser but fail on a customer's phone?
Almost always an incomplete chain. Your desktop browser has cached the intermediate certificate from some previous site and can therefore build a path to a trusted root without help; a device that has not seen it cannot. Run openssl s_client -connect example.com:443 -servername example.com and read the chain block: if it lists only your certificate, the server is not sending the intermediate. AutoSSL assembles the full chain correctly, so this generally appears on a manually installed certificate.
How do I read a certificate's expiry from the command line?
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates prints notBefore and notAfter for the certificate the server is actually presenting. That last part matters: reading the file on disk tells you what is installed, which is not always what is being served, particularly when several hostnames share a vhost.
Can a CAA record stop my certificate being issued?
Yes, and it will do so silently as far as the browser is concerned. A CAA record in your DNS zone names which certificate authorities are permitted to issue for the domain. If it names one that is not the authority issuing here, issuance and renewal both fail while everything else about the domain looks perfectly healthy. Check the zone with dig CAA example.com whenever a renewal stalls and DNS otherwise looks right.
Does HTTPS add measurable latency?
A handshake costs a round trip on the first connection, and that shows in the time_appconnect figure curl reports. In practice it is dwarfed by everything else: session resumption removes it on subsequent requests, HTTP/2 requires TLS anyway, and a cached page served over HTTPS still beats an uncached page served over plain HTTP by an order of magnitude. Measure it with curl if you want the number, but it is not where your response time is going.
Keep reading
How to Change Your PHP Version
Switch PHP per site, then confirm the version and extensions actually loaded.
How to Keep Site Software Updated
Inventory, clone, apply and promote, with a rollback you have tested.
Best Hosting for Wildcard SSL
Wildcard coverage for every subdomain under one name, and when you need it.
Domain Names
Registration, renewal and delegation, with your first year free on annual plans.
WordPress Hosting
WordPress on LiteSpeed and NVMe, with AutoSSL covering every hostname.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Certificates that renew without your attention.
AutoSSL on every hostname that resolves here, free SSL on every plan, wildcard options when you need them, and engineers reachable at any hour.
View Domain Names plans