The five SSL errors you'll actually see
- Expired certificate — past the valid-to date. Renew immediately.
- Common name / SAN mismatch — the certificate doesn't include the domain visitors typed. Reissue with all hostnames listed in SAN.
- Untrusted root CA — issued by an authority not in browser trust stores. Use a recognized CA like Let's Encrypt, DigiCert, or your hosting provider.
- Broken chain — server only sends the leaf cert. Install the full chain bundle.
- Weak protocol/cipher — server still allows TLS 1.0/1.1 or RC4. Enforce TLS 1.2+ and modern cipher suites.
How to fix the most common cases
Expired: issue a new cert via Let's Encrypt (`certbot renew`) or your panel's SSL section. Restart your web server. Hard-refresh the browser.
Mismatch: reissue with both `example.com` and `www.example.com` in SAN. Most providers do this by default if you list both during issuance.
Broken chain: use `fullchain.pem` (cert + intermediates) rather than just `cert.pem`. Verify externally before declaring it fixed — your browser may have the intermediate cached.
Untrusted CA: switch to a public CA. Self-signed certs are never appropriate for public sites.
Preventing SSL outages permanently
Every preventable cert outage in the last decade had the same root cause: nobody was watching the expiry date. Set up automated monitoring that alerts at 30, 14, 7, and 2 days before expiry. Better still, automate renewal via ACME so it never gets that close.