The padlock icon in a browser's address bar is a summary of several separate things, any of which can be wrong on their own.
A TLS certificate is issued for a fixed period and has to be renewed before it expires — an expired certificate causes browsers to show a hard warning page to every visitor, not a subtle one. This is one of the most avoidable outages a website can have: the certificate simply needs renewing before its expiry date, which is public information anyone can check.
TLS has had several versions; older ones (TLS 1.0, TLS 1.1, and the SSL protocols that preceded TLS entirely) have known cryptographic weaknesses and are formally deprecated. A server that still accepts connections using these older protocols is offering a weaker option to any client willing to ask for it — most modern browsers refuse them anyway, but a server that still supports them widens the attack surface for anything that doesn't.
Even with a valid certificate installed, a site that doesn't automatically redirect plain http:// requests to https:// is still reachable unencrypted — anyone who types the address without "https" (or an old bookmark, or a link somewhere that predates the certificate) connects without encryption, and everything in that connection is visible to anyone on the same network.
An expired certificate isn't a minor cosmetic issue — modern browsers block the page entirely with a full-screen warning, which for most visitors reads as "this site is broken" or "this site is dangerous," not "someone forgot to renew something." It's also one of the most preventable findings, since certificate expiry is entirely predictable in advance.
Want to know where your own domain stands? CBWatch checks this — and eight other categories — in about ten seconds, free, no signup.
Run a free scan →Want CBWatch to catch this automatically going forward? See what monitoring includes →