SSL certificate expiry

A certificate expires at a fixed timestamp written inside it. After that moment every browser and every client refuses the connection.

A certificate expires at a fixed timestamp written inside it. After that moment browsers show a full-page warning and API clients refuse the connection outright. There is no grace period.

The usual answer to "how do you monitor this" is that you do not, because you automate the renewal. That is the right first move and it is not the whole answer, for three reasons that all show up in practice.

  1. Automated renewal fails silently. An ACME client whose timer stopped, or whose challenge stopped resolving after a DNS change, leaves no error where anyone is looking. The failure surfaces as an outage sixty or ninety days later.
  2. The certificate served is not always the one renewed. A proxy, a load balancer or a CDN can keep presenting the old file after the origin renewed it. Only a connection from outside sees what visitors see.
  3. Not everything is automated. One internal service, one legacy vendor, one certificate somebody bought by hand.

Monitor the automation from outside it, and the check is one connection a day.

The notification you may be missing

Let's Encrypt ended its own expiry warning emails. Their documentation, last updated 25 June 2025, states:

Let's Encrypt has ended its email expiration service.

A large number of sites were relying on that email as the backstop behind an automated renewal, and it is gone.

What Domduck records

Days remaining, every day, from the certificate reading, along with the issuer. Because every reading is stored, a renewal is visible as an event with a date rather than as a number that quietly reset.

The reading comes from a real connection to the host, which is the only way to see the certificate a visitor gets rather than the one your server thinks it serves.

Why it matters

Expiry is the one failure in this whole subject with an exact known date, which makes ignoring it strange. Certificate lifetimes are also getting shorter, so the number of renewals per year per site keeps rising, and every renewal is a chance for the automation to stop without saying so.

Related

  • TLS certificateA TLS certificate is the signed file a site presents to prove it owns its name, naming the domains it covers and the dates it is valid between.
  • SAN certificateA SAN certificate lists every hostname it covers in its Subject Alternative Name field, which is the only field browsers still read for name matching.
  • Certificate TransparencyCertificate Transparency is a set of public append-only logs recording every certificate a trusted authority issues, so misissuance can be found.

Primary source: Let's Encrypt on ending expiration emails