The communication is still encrypted, but the trust mechanism is undermined. But usually the most important factor is that users will get ugly warning messages about the security of your site. Most won't make informed judgements about the integrity of the connection, they'll just go buy stuff elsewhere.

The communication is still encrypted, but the trust mechanism is undermined. But usually the most important factor is that users will get ugly warning messages about the security of your site. Most won't make informed judgements about the integrity of the connection, they'll just go buy stuff elsewhere.

If the service has HSTS enabled, then it will not be accessible using an expired certificate from an HSTS capable browser - see https://owasp.org/index.php/HTTP_Strict_Transport_Security.

The communication is still encrypted, but the trust mechanism is undermined. But usually the most important factor is that the users will ugly warning messages about the security of your site - and most won't make informed judgements about the integrity of the connection - they'll just go buy stuff elsewhere.

The communication is still encrypted, but the trust mechanism is undermined. But usually the most important factor is that users will get ugly warning messages about the security of your site. Most won't make informed judgements about the integrity of the connection, they'll just go buy stuff elsewhere.