Customers logging into "secure and efficient payment service" Sage Pay this morning were served up an error message saying that the site could not be trusted, and didn't have a valid security certificate.
Looks like someone forgot to renew the site's SSL certificate – which expired at 12:59am this morning.
Customers complaining to Sage Pay's Twitter account were initially told
that the SSL certificate message was an error: "Hi, Its [sic] an error
causing this page to appear. The certificate is still valid and we are
working to resolve this," Sage's PR bod asserted. But that information
was then corrected two hours later: "We're working with the hosting
company to replace the expired cert with our valid in-date one. Just an
It comes less than 48 hours after Sage Pay suffered an intermittent
day-long outage that prevented payments being processed on the network.
In a statement to The Register, Sage Pay said that the certificate snafu
was down to someone outside the company and was purely an admin error:
Today, due to an administrative error with a third party, an expired SSL certificate was displayed on our site.
The spokesperson stressed that at no point was security breached in any way, adding:
It is minor issue, which has no impact on our customers.
We currently have a valid and in-date SSL certificate and are working
with our hosting company to replace the expired certificate on our site.