A hostname mismatch means the certificate is valid but was not issued for the address in the address bar. The usual causes are a missing www, a new subdomain, or a CDN serving the wrong certificate.
Expiry starts a countdown through grace, redemption and pending delete. Each stage costs more to reverse than the last. Here is the timeline and where the deadlines really are.
The error means the certificate is outside its validity window. Here is how to tell whether the fault is your server or the visitor's clock, and how to fix each.
The CA/Browser Forum ballot SC-081v3 cuts maximum certificate validity to 200 days in 2026, 100 in 2027 and 47 in 2029. What changes, and what you have to do about it.