First, work out which kind you have
A certificate with a 90-day life is almost certainly automated, usually Let's Encrypt or your hosting provider. One with a year or more on it was bought and installed by hand.
The free check shows the issuer and the lifetime, which tells you which situation you are in.
If it should renew automatically
- Find where the renewal actually runs. Common places: your hosting control panel, a certbot timer on the server, your CDN or proxy, or a platform that handles it invisibly.
- The usual cause is a server migration that left the renewal job behind, or a name added to the site that was never added to the certificate.
- Trigger a renewal by hand to confirm the mechanism still works, then check the new expiry appears.
- If you cannot find where it runs, that is itself the finding. Someone configured it and left, and it will fail again.
If it was installed by hand
- Buy or issue a replacement before the current one expires, not after.
- Install it along with the intermediate certificate, not just the leaf. Missing the intermediate is the most common installation mistake and it fails silently for some visitors.
- Check every name the old certificate covered is on the new one.
- Verify after installing, from a machine that has never visited the site.
Why you cannot test this from your own browser
Your machine caches intermediate certificates it has seen before. A site with an incomplete chain loads perfectly for you and fails for a visitor whose machine has not cached it. Checking it yourself will not reveal the problem, which is why it can run broken for months.
On finding where the renewal actually runs: the automated certificates guide.