A clinic website we run went from fine to 'Your connection is not private' (NET::ERR_CERT_DATE_INVALID) without anyone touching it. The site is hosted on Vercel, but the domain was bought on Hostinger and its DNS is managed there — a very common setup for Indian small businesses. Nothing had been deployed. So where did an expired certificate come from?
Step 1: look at the certificate itself
The certificate the browser received had expired almost two years earlier. Vercel renews its certificates automatically, so an ancient expired certificate meant visitors were not reaching Vercel at all. The response headers confirmed it: they came from a PHP server with Hostinger's panel signature, not from Vercel. Visitors were landing on the old WordPress install that still sat, forgotten, on the client's hosting plan.
Step 2: check Hostinger's DNS history
Hostinger's DNS zone has a history tab. It showed a 'Hosting CDN enabled' event a couple of weeks earlier that nobody on our side had made. Turning that CDN on replaces your records: the root domain becomes an ALIAS to Hostinger's CDN and www becomes a CNAME to it, overriding the records that point to Vercel. Traffic then flows to whatever Hostinger hosts for that domain — here, the dormant WordPress site with its long-expired certificate.
Step 3: fix the records, not the whole zone
Hostinger offers a 'Reset DNS records' button. Don't press it: it would also wipe the MX records, and the clinic's email would stop arriving. Instead, delete only the ALIAS record and add an A record for the root domain with the IP shown on your Vercel project's Domains page, then set the www CNAME to the target Vercel shows there. Leave MX, SPF and verification TXT records alone. Turn the CDN off in the hosting panel so it doesn't come back. Once the new records propagated, Vercel issued a fresh certificate and the site was back.
Step 4: test like an outsider
Your own router or ISP often caches old DNS answers for days. In our case, a local router was still handing out stale records long after the public internet had the new ones. Test with public resolvers (Google 8.8.8.8 or Cloudflare 1.1.1.1), or ask a tool that queries from several countries, before deciding a fix hasn't worked.
A related trap: old IPv6 records
When we moved the same clinic's old .in domain to Vercel, IPv4 visitors got the new site but some visitors still saw the old one. The zone had an AAAA (IPv6) record pointing at the old host that never appeared in the main record list. Delete AAAA records for the root and www when moving a domain to Vercel, unless Vercel asks for them.
Our checklist now, for every Hostinger-to-Vercel move
turn Hosting CDN off before changing anything; delete old A, AAAA and CNAME records for the root and www; add Vercel's A and CNAME values; keep MX, SPF, DKIM and verification records; confirm the certificate and redirect from public resolvers; and only cancel the old hosting plan after a couple of weeks. If a Hostinger-plus-Vercel site ever shows a certificate error out of nowhere, open DNS history first — it's usually there.
Need a hand moving a site or untangling DNS? HowAutomate does this as part of our website work, including the email records most guides forget.
Frequently asked questions
Why does my Vercel site suddenly show an expired SSL certificate?
If your DNS is on Hostinger, check DNS history for a 'Hosting CDN enabled' event. Enabling it replaces your records with Hostinger's CDN, sending visitors to whatever Hostinger hosts — often an old site with an expired certificate.
Should I use Hostinger's 'Reset DNS records' to fix it?
No. Resetting also removes your MX records and stops your email. Change only the root A record and the www CNAME to Vercel's values, and turn the CDN off.
Which DNS records does Vercel need?
An A record for the root domain and a CNAME for www, using the values shown on your Vercel project's Domains page. Remove old A, AAAA and CNAME records for the root and www, and keep MX, SPF, DKIM and verification records.
Why do I still see the old site after fixing DNS?
Your router or ISP may be caching old answers. Check with public resolvers like 8.8.8.8 or 1.1.1.1, flush your computer's DNS cache, or restart the router.
Amit has 6+ years of experience building data pipelines, AI agents, and automation systems for businesses across India and globally. He founded HowAutomate to make enterprise-grade automation accessible to growing businesses.