Your site says “Not secure”: HTTP, expired certificates and shrinking certificate lifetimes.

A browser’s “Not secure” or “Your connection is not private” warning means that the site either does not offer HTTPS or offers a certificate that has expired, belongs to another name, or is not signed by an authority the browser trusts.

Why does the browser say “Not secure”?

The warning comes in two families, and each has a different fix. In the first, the site does not offer HTTPS: the connection is unencrypted and the browser shows “Not secure” in the address bar. In the second, the site offers HTTPS but its certificate has a problem: the browser does not open the page at all and shows a full-page warning, “Your connection is not private”, with an error code underneath.

• NET::ERR_CERT_DATE_INVALID — the certificate has expired. Rarely, the visitor’s device clock is wrong; if it shows on several devices, the problem is the site.
• NET::ERR_CERT_COMMON_NAME_INVALID — the certificate belongs to another name. The most common cause is that either the www or the non-www address is missing from the certificate.
• NET::ERR_CERT_AUTHORITY_INVALID — the certificate was not signed by an authority the browser trusts: a self-signed certificate, or an intermediate certificate left off the server.
• Mixed content — the page opens over HTTPS, but an image or script inside it comes over HTTP. The browser either upgrades these to HTTPS or blocks them; the page may look broken.

To a visitor, both families mean the same thing: do not leave your details on this site. A quote request, or a foreign buyer’s first visit, ends on this screen.

What did Chrome 154 change for HTTP sites?

Chrome 154 reached the stable channel on September 22, 2026 and turned on the “Always use secure connections” setting by default. According to Google, Chrome now asks for the user’s permission before the first visit to any public site without HTTPS. The mechanism has been in place since 2023: Chrome first tries to open an http address over https on its own, and if HTTPS does not work (the certificate is invalid or the server offers no HTTPS) it falls back to http; Chrome 154 put the permission prompt in front of that fallback. The user can continue; on a site they visit regularly the warning does not repeat, it appears on a new or not recently visited site. Local network addresses and single-word internal names are excluded; organizations can change this behavior through policy.

For a site owner, the consequence is this: a site whose HTTPS does not work at all, or whose certificate is invalid, greets every new visitor with a warning screen. The new visitor is the one a site can least afford to lose: the buyer about to ask for a quote, the customer looking for you for the first time.

Why are certificate lifetimes getting shorter?

The CA/Browser Forum, the joint body of browser makers and certificate authorities, adopted a rule in April 2025 that shortens the maximum validity of a TLS certificate step by step. The schedule follows the date the certificate is issued:

• Issued before March 15, 2026 — at most 398 days (about 13 months).
• From March 15, 2026 — at most 200 days.
• From March 15, 2027 — at most 100 days.
• From March 15, 2029 — at most 47 days.

Maximum validity of a TLS certificate

1. 01Before March 15, 2026 · 398 days
2. 02March 15, 2026 · 200 days
3. 03March 15, 2027 · 100 days
4. 04March 15, 2029 · 47 days
5. LELet’s Encrypt default: 90 today · 64 from February 10, 2027 · 45 from February 16, 2028

The same rule shortens how long the validation that proves the domain is yours can be reused; by 2029 that window drops to 10 days. So renewal is no longer just replacing a file, it means proving control of the domain again and again. Let’s Encrypt, which issues free certificates, is shortening its own default as well: certificates that are valid for 90 days today will be valid for 64 days from February 10, 2027 and for 45 days from February 16, 2028.

Is buying an “annual SSL certificate” still worth it?

You can still buy a one-year or multi-year SSL product; but since March 15, 2026 a single certificate is valid for at most 200 days. The “annual” product has to be reissued and installed on the server at least twice a year; at least four times after March 15, 2027, and at least eight times a year after 2029. Every manual installation, on the day it is forgotten, means an expired certificate and a “Your connection is not private” screen.

So the real question is not the price of the certificate but who renews it and how. Shorter lifetimes make manual renewal impractical.

How is automatic renewal set up?

The standard way to renew certificates automatically is the ACME protocol: software on the server requests the certificate before it expires, validates the domain and installs the new one. Let’s Encrypt, ZeroSSL and Google Trust Services issue free certificates this way; many hosting panels ship this ready as an automatic certificate feature, and content delivery networks such as Cloudflare renew their own edge certificates.

• Who renews the certificate? The hosting company, the content delivery network, the agency that built the site, or you — there should be one written answer.
• Is renewal automatic? If not, the 2027 schedule means at least four manual jobs a year.
• Who is notified if renewal fails? If the warning email goes to an address nobody reads, automatic renewal can stop silently.
• Does the certificate cover every name? The www and non-www addresses and any subdomains in use should be on the certificate.
• Is anyone watching the expiry date from outside? Checking the remaining days regularly is the only way to notice before a visitor does.

Does the http address redirect to HTTPS?

Even with a valid certificate, the site’s http address should redirect to the https address in one step, and the site should send the HSTS header that tells the browser to open it over HTTPS only. Chrome tries to upgrade an http address to https on its own; but old links, other browsers and search engines still need the redirect. How to write the redirect on the server is in the HTTPS and www redirect guide.

What is the situation on Turkish sites?

On November 8, 2026 we measured the 500 most-visited .tr sites in Turkey, the sites of large exporters and randomly selected .com.tr sites. The share of sites that Chrome 154 will open behind a warning is 1 per cent, 2 per cent and 8 per cent in these three groups; the share whose http address does not redirect to https is 9 per cent, 18 per cent and 22 per cent. The real work comes on March 15, 2027: the share of sites using a certificate longer than 100 days today is 65 per cent, 41 per cent and 13 per cent. Method and all figures in the measurement article.

What should the proposal and the contract say?

A certificate is not an item you install once and forget; it is part of the site’s annual running cost (what determines the price of a website). A website proposal should state in writing who is responsible for renewal, whether it is automatic, and who will be notified before it expires (how to read a web design proposal). For all of a site’s security topics, see the website security guide.

Checklist

• Does the address bar show “Not secure”? If so, HTTPS has to be set up first.
• Which error code does the “Your connection is not private” screen show? Date, name or authority — the fix depends on the code.
• What are the certificate’s expiry date and lifetime? If it is longer than 100 days, the renewal routine will change after March 15, 2027.
• Is renewal automatic, who does it, and who is notified if it fails?
• Are the www and non-www addresses and the subdomains on the certificate?
• Does the http address go to https in one step, and is the HSTS header there?

These checks belong on a site’s handover list; in web design and development work, the certificate and redirects are measured before launch.

If you want to see these answers on your own site, corporate web design delivers design, code and technical SEO from one hand, on a measurable budget.