TLS certificate problems that hurt small business websites

Published October 27, 2026

A TLS certificate, still often called an SSL certificate, does two jobs: it proves that a website is really the one it claims to be, and it encrypts the traffic between the visitor and the site. When it goes wrong, visitors see a full-page browser warning, and security checks flag the site. Most certificate problems are simple and preventable.

The common problems

• An expired certificate. The most common and the most visible. Browsers show a warning that most visitors will not click through, so the site is effectively down. Maximum certificate lifetimes have been getting shorter, and are scheduled to keep shrinking, so renewing by hand becomes riskier every year.
• A name mismatch. The certificate was issued for www.example.com but visitors arrive at example.com or at another subdomain. The name in the address bar must be covered by the certificate.
• An incomplete chain. A certificate usually needs an intermediate certificate installed with it. If that is missing, the site may work in your browser and fail on phones, older devices or other software.
• Old protocol versions. SSL 3.0 and TLS 1.0 and 1.1 are deprecated and should be turned off. Servers should offer TLS 1.2 and 1.3.
• Weak encryption settings. Outdated ciphers such as RC4 and 3DES, and RSA keys shorter than 2048 bits, should not be in use.
• A self-signed certificate on a public service. Browsers do not trust it, which trains visitors and staff to click through warnings.
• Forgotten certificates. Mail servers, VPN gateways, office equipment and old subdomains all carry certificates, and they are the ones that expire unnoticed.

How to check

In a browser, click the padlock beside the address, then the certificate details, to see the name it covers and when it ends. For a complete picture you need to check every public name you own, not just the main website. An external scan of your domains does that and also reports protocol and cipher settings.

How to avoid the problems

1. Automate renewal. Use your host's managed certificates, or a free automated authority such as Let's Encrypt where it fits. Anything renewed by hand needs a calendar reminder and a named owner.
2. Watch the expiry dates and get a warning at least 30 days ahead, for every name, not just the main site.
3. Redirect HTTP to HTTPS so visitors never land on an unencrypted page.
4. Update server settings to turn off old protocols and weak ciphers. Most hosting panels and web servers have a recommended configuration to copy.
5. Remove what you no longer use, including certificates and the subdomains they cover.

How Frontage helps

Frontage checks the certificates on your authorized domains for expiry, name coverage and chain problems, and reports outdated protocols and weak settings. Because it checks on a schedule, a certificate that is nearing its end shows up as a finding before visitors see a warning.