A certificate is not a one-off purchase. It has a start date and an end date, and when the end arrives every browser stops trusting it - not because anything broke, but because that is what a certificate is. Renewal There is no automatic renewal at the certificate level. Note the expiry date from the order and start the replacement early enough that there is no gap. Where a site is business-critical, renewing a few weeks ahead removes the risk of a validation email arriving at a bad moment. The common errors, and what they mean Not secure, even though a certificate is installed. Usually the page still loads some resources over http, or http has not been redirected to https. Fix the page and add the redirect. Certificate does not match this domain. The certificate was issued for one form of the name and you are visiting another - www versus the bare domain is the classic case. Either issue for both or make one redirect to the other. Certificate has expired. The renewal did not happen, or the new certificate was issued but the old one is still installed on the server. Incomplete certificate chain. The domain certificate is installed without the intermediate certificate. Many clients cope, some do not, and the ones that do not show a warning. Only some pages warn. Those pages load something from another domain that has no certificate, or a stale certificate of its own. Where the boundary is We issue and deliver the certificate. Installing it - and re-installing it when you move servers - is done on your side. The private key belongs on your server and should not be sent to us or to anyone else: a leaked private key means somebody else can impersonate the site, and the certificate has to be reissued. Before you order Decide whether both the bare domain and www need to work. Check whether the certificate type covers additional hostnames, and add them at order time rather than discovering the need after it is issued.