# How to fix certificate expiry and chain errors

> An expired or incomplete certificate shows visitors a full-page warning. Automate renewal and send the full chain.

Security · HTML version: https://getreport.app/learn/tls-certificates

## Certificate chain

Passing looks like: The TLS certificate chain validates.

**Why it matters.** Browsers cannot verify who issued the certificate, so visitors see "Your connection is not private" instead of your page. The usual causes are a missing intermediate certificate, an expired certificate or a name mismatch.

**How to fix it.**

1. Install the full chain (your certificate plus the intermediate) that your certificate authority provides, not just the leaf.
2. Check that the certificate covers exactly this hostname, with and without www.

## Certificate expiry

Passing looks like: Certificate expiry passes.

**Why it matters.** When the certificate expires, every browser shows a full-page warning and most visitors leave. Automatic renewals fail silently more often than you would expect.

**How to fix it.**

1. Renew the certificate now; with Let's Encrypt, run certbot renew and check the auto-renew job's logs.
2. Add a monitor so you get an email 14 days before the next expiry.

Check your own page: https://getreport.app/