A "Not Secure" warning or certificate error means the browser doesn't trust your SSL — usually it expired, is mismatched, has renewal broken, or the page is mixing http and https content. Here is how to fix each.
Quick answer
A "Not Secure" warning usually means the SSL certificate expired, does not match the domain, or the page loads some content over plain http. Renew the certificate (Let's Encrypt certificates last 90 days — run certbot renew or renew in your panel), fix why automatic renewal failed (often port 80 or DNS), and change mixed http links to https.
Expired certificate
Let's Encrypt certs last 90 days and are meant to auto-renew. If yours expired, renewal stopped running. Force a renew and check the timer:
certbot renew --force-renewal
systemctl status certbot.timer # is auto-renew active?Why renewal fails
- HTTP-01 challenge blocked — port 80 must be reachable; the
.well-known/acme-challengepath must serve files. - DNS changed — the domain must still point to this server.
- Rate limited — too many failed attempts; wait before retrying.
- The cron/timer was removed — re-enable certbot.timer.
"Not Secure" but cert looks valid
Often mixed content — the page loads some resources over http://. Update those to https:// (or use a plugin/rule), and make sure the site redirects http to https. A cert for the wrong domain (www vs non-www) also triggers it.
DirectAdmin/cPanel have a Let's Encrypt button that handles issuing and auto-renewal. Use it rather than hand-running certbot if you're on a panel.
Expired = renewal stopped (fix the timer + the ACME challenge). "Not secure" with a valid cert = mixed content or a domain mismatch.
Cause: wrong or missing intermediate certificate chain
Some setups install only the leaf certificate without the intermediate chain. Browsers may still show it as valid while some tools/APIs flag it as untrusted. Use an SSL checker to confirm the full chain is served, not just the certificate itself.
How to prevent SSL/renewal problems
- Use your panel's Let's Encrypt integration instead of a hand-rolled cron job where possible.
- Monitor certificate expiry with an uptime/SSL monitor so you find out before visitors do.
- Never block port 80 entirely if you rely on the HTTP-01 challenge.
- Keep DNS pointed correctly at your server at all times.
Related errors
A redirect loop after installing SSL usually means Cloudflare/WordPress settings disagree — see too many redirects. If the domain itself won't resolve, that's a DNS problem, not SSL — see pointing a domain (A record).