SSL Certificate Expiry: How to Never Get Caught Offline

A silent, avoidable outage

When a TLS certificate expires, browsers stop trusting the site and show a full page warning. To a visitor, that looks exactly like being hacked. The service is running perfectly, but nobody can use it.

The frustrating part is that this outage is completely predictable. The expiry date is known in advance, which means it should never surprise you.

Automate renewal, but verify it

Automatic renewal, through a provider or a tool like the ACME protocol, is the right default. But automation fails quietly. A renewal hook that breaks after a config change will not tell you until the certificate lapses.

So automate renewal, and then monitor the actual expiry date independently, as a backstop.

Get warned with room to act

Track the certificate expiry on every domain and subdomain, and get a reminder well before the date, not the morning of. Two weeks of warning gives you time to fix a broken renewal calmly instead of during an incident.

Do not forget the edges

The certificates that lapse are usually the forgotten ones: an old subdomain, an internal tool, an API endpoint. Inventory every certificate you rely on and monitor them all, so the one you forgot about does not become tomorrow's outage.