How to Fix SSL Certificate Errors on Your Website: A Hosting Troubleshooting Checklist
SSL certificate errors can come from several different layers: DNS, the hosting account, the certificate itself, redirects, or website code. This checklist helps you identify the layer causing the problem, apply the least disruptive fix, and confirm that your website is working securely over HTTPS.
Overview
An SSL certificate allows a browser to establish an encrypted HTTPS connection with your website. Although people commonly refer to these as SSL certificates, modern certificates are generally used with TLS. The practical troubleshooting process is the same: confirm that the correct domain reaches the correct server, that a valid certificate covers the requested hostname, and that the website consistently loads resources over HTTPS.
A certificate warning does not always mean the certificate has expired. Common causes include a domain pointing to an old host, a certificate issued for the wrong hostname, an incomplete certificate installation, a redirect loop, an incorrect server time, or images and scripts still loading over HTTP. A careful diagnosis is safer than repeatedly reinstalling certificates or changing DNS records without a plan.
Before making changes, record the exact browser message, the affected URL, and whether the issue affects the root domain, the www version, a subdomain, or every page. If the website was recently moved, connected to a CDN, or switched to a new hosting plan, include that detail in your notes. These changes often determine which layer should be checked first.
Checklist by scenario
1. The browser says the certificate is expired
- Open the hosting control panel and check the certificate's status and renewal settings.
- Confirm that the certificate covers every hostname visitors use, such as the root domain and
www. - Check whether the domain currently points to the server where the certificate was installed.
- After renewal or installation, test the site in a private browser window and on more than one network if possible.
If automatic renewal fails, the cause may be a DNS mismatch, a disabled validation method, or a change in the hosting configuration. Resolve the validation issue before repeatedly requesting new certificates. If you use a managed WordPress plan, consult the provider's SSL setup area rather than installing a second certificate through a separate tool.
2. The warning says the certificate is for the wrong domain
This usually indicates that the server is presenting a certificate for another hostname. Check whether the address in the browser exactly matches the name covered by the certificate. Differences between example.com, www.example.com, and a subdomain matter.
- Review the domain and subdomain list in the hosting panel.
- Confirm that each hostname points to the intended server.
- Verify that the HTTPS virtual host or site configuration selects the correct certificate.
- Remove outdated redirects or duplicate site entries that may send visitors to another hostname.
Do not assume that adding an unrelated certificate will fix the problem. The certificate, DNS records, and server configuration must refer to the same hostname.
3. HTTPS does not load after a domain or hosting change
Start with DNS. Compare the domain's current A, AAAA, or relevant alias records with the destination supplied by your host or DNS provider. An old record can send some visitors to a previous server, while an IPv6 record can send others to a different destination than the IPv4 record.
Next, check the nameservers at the registrar. If you recently changed nameservers, the active DNS zone may be managed somewhere other than the panel you are editing. Use a DNS lookup tool to confirm which records are publicly visible, but allow for caching while changes take effect.
For a broader migration workflow, see How to Move a WordPress Site to a New Host and How to Transfer a Domain Without Downtime.
4. The site shows an HTTPS redirect loop
A redirect loop occurs when one layer believes the request is HTTP while another believes it is already HTTPS. Check the following in order:
- Confirm that HTTPS works directly before forcing redirects.
- Review the hosting panel's HTTPS redirect setting.
- Check application settings, such as the site URL and WordPress address, for mixed HTTP and HTTPS values.
- Inspect redirect rules in
.htaccess, the web server configuration, or a redirect plugin. - If a CDN or proxy is active, review its encryption mode and origin connection settings.
Use one clear redirect owner where possible. Multiple redirect rules across the application, hosting panel, CDN, and web server make loops difficult to isolate.
5. The page loads, but the browser reports mixed content
Mixed content means the main page uses HTTPS while one or more resources still request HTTP. Typical examples include images, stylesheets, JavaScript files, fonts, embedded media, and analytics endpoints.
- Use the browser's developer tools to identify the exact insecure URL.
- Change hard-coded resource links from HTTP to HTTPS.
- Update image URLs, theme files, plugins, scripts, and database content where applicable.
- Replace third-party resources that do not support HTTPS, or remove them if they are no longer needed.
- Clear site, plugin, CDN, and browser caches before retesting.
Do not hide mixed-content warnings by adding more redirects alone. The page source or the resource provider must ultimately request the secure URL.
6. The certificate is installed, but visitors still see a warning
Check whether the complete certificate chain was installed, particularly if the host requires a certificate file and an intermediate certificate bundle. Also verify that the certificate was installed on the active server rather than an unused hosting account. If the website sits behind a CDN, test both the public endpoint and the origin connection according to the provider's documentation.
For WordPress sites, the WordPress Hosting Setup Checklist provides a useful companion review for security, backups, and configuration.
| Symptom | First area to check | Likely action |
|---|---|---|
| Expired certificate | Hosting panel and renewal status | Fix validation or renew the certificate |
| Wrong domain displayed | Hostname coverage and site mapping | Install or select the certificate for the correct hostname |
| HTTPS redirect loop | Redirect and proxy settings | Remove conflicting rules and align HTTPS detection |
| Mixed content | Page source and browser console | Change resource URLs to HTTPS |
| Works on one hostname only | DNS and certificate coverage | Configure both intended hostnames consistently |
What to double-check
- Domain ownership: Make sure you are editing the DNS zone and hosting account that serve the live website.
- Hostname coverage: Test the root domain,
www, important subdomains, and any custom checkout or login hostname. - DNS records: Review A, AAAA, CNAME, and nameserver settings after migrations or registrar changes.
- Server time: An incorrect system clock can cause otherwise valid certificates to appear outside their validity period.
- Certificate chain: Confirm that the hosting platform has the required intermediate certificates.
- Redirect order: Check the response path from HTTP to HTTPS and from one hostname to another. A long chain or a loop signals conflicting configuration.
- Application URLs: Update the site's canonical URL, media URLs, and stored links after enabling HTTPS.
- Caching: Purge relevant caches only after fixing the underlying configuration, then retest from a private window.
HTTPS is one part of overall website performance and security. If errors began after a hosting change, compare the current setup with your provider's documentation and review the wider Website Speed and Hosting Performance Checklist.
Common mistakes
Changing DNS repeatedly. DNS changes can make diagnosis harder, especially when the real problem is an incorrect certificate selection or redirect rule. Change one layer at a time and record what changed.
Testing only one hostname. A certificate may work for www while the root domain fails, or the reverse. Test every public hostname that matters to visitors and search engines.
Installing several competing SSL tools. A hosting-panel certificate, a plugin, a CDN setting, and custom server rules can conflict. Choose a clear certificate and redirect path.
Ignoring the origin server. A CDN can make the public site appear secure while the connection between the CDN and host remains misconfigured. Review both sides when a proxy is involved.
Forcing HTTPS before verifying it works. First confirm that the certificate loads correctly. Then enable the redirect and update application URLs. This sequence reduces the risk of locking visitors into a loop.
When to revisit
Keep this checklist available whenever you renew a certificate, change hosting, transfer a domain, update nameservers, add a subdomain, enable a CDN, or rebuild a website. It is also useful before seasonal campaigns and after any change to checkout, login, email, or third-party integrations.
Set a recurring review for certificate status, DNS ownership, redirect behavior, and mixed-content warnings. Revisit the process when your hosting panel, CDN, CMS, or certificate workflow changes, because labels and validation steps may differ between providers. For hosting decisions that affect the troubleshooting process, compare the trade-offs in Shared Hosting vs VPS vs Cloud Hosting and review long-term costs in Web Hosting Renewal Prices Compared.
Final action: write down the exact error, identify the affected hostname, check DNS, confirm the certificate, review redirects, fix application resources, clear caches, and retest each public URL. If the warning remains after those checks, give your hosting or CDN provider the hostname, timestamp, error message, and recent configuration changes so they can investigate the correct layer.
