SSL certificate expiry: what to watch, and when

Every TLS certificate has a fixed validity window, and when it ends browsers stop trusting it. Expiry is the certificate failure sites hit most often, and the easiest to prevent, yet it still takes large sites down, because the date sits in a file nobody is watching until a customer reports an error. An expired certificate does not degrade gracefully: the site throws a full-page security warning, and most visitors simply leave rather than click through it.

The window is getting shorter. In April 2025 the CA/Browser Forum adopted a schedule that cuts the maximum TLS certificate lifetime from 398 days today to 200 days in March 2026, 100 days in March 2027, and 47 days in March 2029. Domain-validation reuse shrinks alongside it. Shorter lifetimes mean more renewals, more chances for an automated renewal to fail silently, and far less room for a monitor that only checks once in a while.

Watching expiry well means more than a single alert on the day. A useful monitor warns on a ladder — a month out, then a fortnight, a week, and a day — so a missed renewal has several chances to be noticed. It should also watch the earliest expiry across the whole served chain, not just the leaf, because an intermediate can lapse first. And it should read the date from the certificate the server actually presents, so a renewal that succeeded but never reloaded is still caught.