Certificates

SSL certificate expiry monitoring: catch the renewal that did not happen

Most SSL certificates renew themselves, so the one that expires is the one whose automation broke. Certificate lifetimes are falling from 398 days to 47 by 2029, and Let's Encrypt stopped emailing expiry warnings in June 2025. Here is how to check a certificate's expiry yourself, why auto-renewal fails, and when an alert should fire.

Published 28 October 2026 · Figures checked against primary sources, not recalled.

An expired certificate does not take a site down quietly. Every visitor gets a full-page browser warning, forms stop submitting, and API clients refuse the connection. Unlike a lapsed domain, it usually happens to a site whose owner believed renewal was automatic.

Certificates are getting shorter

In April 2025 the CA/Browser Forum, the body that sets the rules public certificate authorities follow, passed Ballot SC-081v3. It cuts the longest a public TLS certificate may be valid in three steps:

Issued on or after	Longest validity
Before 15 March 2026	398 days
15 March 2026	200 days
15 March 2027	100 days
15 March 2029	47 days

A shorter certificate means more renewals a year, and each one is a chance for the automation to fail. The yearly certificate someone renewed by hand is going away.

The reminder many people relied on has already gone. Let's Encrypt stopped sending expiration notification emails on 4 June 2025, so a Let's Encrypt certificate whose renewal fails now expires with no warning from the issuer.

Why automatic renewal fails

Renewal clients such as Certbot renew a certificate once about a third of its lifetime is left, which is 30 days on a 90-day certificate (Certbot documentation). When it fails, it is almost always for one of these reasons:

The site moved and the renewal did not. DNS now points at a new host or a CDN, while the old server keeps trying to renew a certificate for a name it no longer serves.
The challenge cannot be reached. HTTP validation needs /.well-known/acme-challenge/ to answer on port 80. A firewall, a redirect rule or a CDN setting in front of it makes every attempt fail.
DNS credentials expired. DNS validation, which wildcard certificates require, uses an API token at the DNS provider. When that token is rotated or revoked, renewals stop.
A CAA record names another CA. If the domain's CAA record does not allow the issuing CA, it must refuse to issue.
It renewed, but the server never reloaded. The new certificate is on disk while the web server is still serving the old one from memory.
The certificate does not cover the name people visit. It was issued for example.com, and www.example.com serves something else.

None of these produces an error anyone sees until the old certificate runs out.

How to check a certificate's expiry

In a browser, click the padlock (or the site-settings icon) and open the certificate details. The "Expires on" or "Valid to" date is the certificate's notAfter field, the moment it stops being valid (RFC 5280).

From a terminal, OpenSSL reads the same date from the live server:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -enddate -issuer

It prints a line such as notAfter=Jan 9 12:00:00 2027 GMT, plus the issuer. The -servername flag matters: without it, a server hosting several sites may hand back the certificate for a different one.

Check the names visitors actually use, which usually means both the bare domain and www. They can have different certificates, and only one of them may be broken.

When an alert should fire

An alert at 30 days fires on almost every healthy certificate, because that is when automatic renewal normally happens. People soon learn to ignore it. The signal worth an email is a certificate that is still not renewed after that window:

14 days left: the renewal is overdue and the automation has likely failed. There is time to fix it calmly.
7 days and 1 day left: the same problem is still unfixed.
Expired: visitors are seeing the warning now.

As lifetimes shrink toward 47 days, renewal at a third of the lifetime moves to about 16 days out, so an alert at 14 days still means a renewal that did not happen.

Certificate expiry is not domain expiry

The two run on separate clocks and are often handled by different people. The domain is renewed at the registrar, usually once a year. The certificate is renewed by the web host or CDN, every few months. Either one can lapse on its own, but if the domain lapses, the certificate is gone too: no certificate authority will issue one for a name you no longer control, and the site stops resolving anyway. That is why it makes sense to watch them together.

What DropPerch checks. Each day a domain is due, DropPerch connects to it over HTTPS (the bare domain first, then www) and records the certificate's expiry, its issuer, and whether browsers trust it. An expired, self-signed or wrong-name certificate is reported as such rather than skipped. Subdomains such as shop.example.com are not checked separately.

Common questions

How do I check when an SSL certificate expires?

Open the certificate details from the padlock in your browser and read the "Expires on" date, or run openssl s_client against the site and pipe it to openssl x509 -noout -enddate, which prints the certificate's notAfter date.

Why did my SSL certificate expire if it renews automatically?

Automatic renewal fails silently when DNS has moved to another host, the validation challenge is blocked by a firewall or CDN, DNS API credentials have expired, a CAA record forbids the issuing CA, or the server was never reloaded after the new certificate was written.

Does Let's Encrypt still email before a certificate expires?

No. Let's Encrypt ended its expiration notification emails on 4 June 2025, so a failed renewal now goes unannounced unless you monitor the certificate yourself.

How long are SSL certificates valid now?

Under CA/Browser Forum Ballot SC-081v3, public TLS certificates issued from 15 March 2026 may be valid for at most 200 days, from 15 March 2027 for at most 100 days, and from 15 March 2029 for at most 47 days.

Sources

Watch the certificate with the domain

DropPerch reads the SSL certificate on every domain you watch alongside its registry record, and emails you at 14, 7 and 1 days before the certificate expires, and once if it does.

Start watching free