How to Prevent SSL Certificate Expiry: The Complete Checklist
SSL certificate expiry is one of the most preventable causes of website downtime. Yet it still happens to organizations of every size — from startups to Fortune 500 companies. The reason is almost always the same: no systematic process for monitoring and renewing certificates. This checklist fixes that.
Why Certificates Still Expire (Despite Best Intentions)
Teams know certificates expire. The problem is execution: certificate ownership is unclear, alerts are set to only one channel that nobody checks, renewal reminders are calendar events that get dismissed, or auto-renewal fails silently on an expired credit card.
Certificate lifetimes are also shortening. The CA/Browser Forum has approved a move to 47-day maximum validity starting in 2026, and Apple plans to enforce 90-day limits in Safari. Shorter lifetimes mean more frequent renewals — increasing the risk of failure if processes are manual.
The Complete Prevention Checklist
Inventory & Discovery
Monitoring & Alerting
Renewal Process
Automation
When Auto-Renewal Fails
Auto-renewal is not foolproof. Common failure modes include:
- DNS challenge fails due to a DNS provider API key expiry
- HTTP challenge fails because port 80 is blocked by a firewall rule change
- Let's Encrypt rate limits are hit on shared IPs
- Cloud certificate manager loses access to the domain due to IAM permission changes
- The certificate is renewed but deployment to the load balancer fails silently
The only way to catch auto-renewal failures is to monitor the actual certificate in production — not just your renewal job's exit code. An external monitoring service checks the live certificate independently of your renewal infrastructure.
The 30-Day Rule
Important — if your certificate has fewer than 30 days remaining, treat it as urgent — not routine. 30 days gives you time to deal with unexpected complications: DNS propagation delays, CA validation issues, deployment rollbacks, and team availability gaps during holidays or weekends.
Use our free SSL Certificate Checker to instantly check any domain's certificate expiry date, issuer and TLS version.
Common questions
How far in advance should I renew an SSL certificate?
Renew at least 30 days before expiry. Most CAs allow renewal up to 90 days early without losing the remaining validity. For Let's Encrypt (90-day certificates), renewal 30 days early is standard. Have monitoring alerts start at least 30 days out and repeat until the certificate is renewed, to give yourself enough time.
Why do SSL certificates expire automatically?
SSL certificates have a built-in expiry to limit the damage from a compromised private key and to force periodic key rotation. The maximum validity period is currently 398 days (about 13 months). Shorter validity — like Let's Encrypt's 90 days — encourages automation and reduces exposure windows.
What happens when an SSL certificate expires?
Browsers display a full-page security warning and block access to the site by default. Users see messages like "Your connection is not private" (Chrome) or "Warning: Potential Security Risk Ahead" (Firefox). Most users will leave immediately rather than click through. Search engines may also de-index or flag the page.
How do I prevent SSL certificate expiry?
The most reliable approach is automated renewal — Let's Encrypt with Certbot renews automatically every 60 days. For manually managed certificates, set calendar reminders and use a monitoring tool like CertNotify that checks daily and emails you every day once a certificate is inside the lead time you choose.
References and further reading
The specifications and primary documentation this article is based on.
- CA/Browser Forum
Publishes the Baseline Requirements every public CA must follow.
- Let's Encrypt — Documentation
- RFC 8555 — Automatic Certificate Management Environment (ACME)
Read next
More guides on the same subject.