SSL Certificate Risk Calculator
Calculate your expiry risk score and get an actionable remediation plan. Results update instantly as you adjust inputs.
Certificate Details
Configuration
Risk Factors
| 45 days remaining — plan renewal | +15 |
| No auto-renewal configured — manual process | +20 |
| No expiry monitoring — no early warning | +10 |
Recommended Actions
Why Certificate Expiry Is a Risk You Can Quantify
Every SSL/TLS certificate has a hard deadline baked into it, and the moment it passes, browsers stop trusting your site — no grace period, no warning banner for visitors, just a full-page security error. Expiry outages are unusual among production incidents in that they are 100% predictable: the date is known months in advance. They still happen constantly, because the renewal depends on a chain of small things going right — a payment method on file at the CA, a DNS record that still resolves, a cron job that survived the last server migration, a person who still works at the company reading the reminder email.
This calculator turns those failure modes into a single 0–100 score. It is deliberately weighted so that time remaining dominates: a perfectly automated setup with 3 days left is still an emergency, while a manual process with 300 days of runway is merely a task. The remaining points capture how wide the blast radius would be (wildcard and multi-domain certificates take many services down at once) and whether anything would warn you before the deadline.
The stakes keep rising as maximum certificate lifetimes shrink. Public certificates were capped at 398 days in 2020, and the CA/Browser Forum has approved a phased reduction to roughly 47-day certificates by 2029. In that world a renewal happens for every domain every few weeks — which is exactly why the two configuration checkboxes in this calculator (auto-renewal and monitoring) are worth 30 risk points between them.
How to Read Your Score
The Ways Certificates Actually Expire in Production
Certbot timers stop firing after OS upgrades, and ACME DNS-01 challenges break when nameservers change. Verify with `systemctl list-timers certbot*` and do a dry run: `certbot renew --dry-run`.
A renewed file on disk does nothing until the web server reloads it. Add a deploy hook — for certbot: `--deploy-hook "systemctl reload nginx"` — and verify what is actually served: `openssl s_client -connect example.com:443 | openssl x509 -noout -enddate`.
The main site renews fine while api.example.com, the mail server, or an internal admin panel quietly lapses. Inventory every TLS endpoint (Certificate Transparency logs help you find forgotten ones) and monitor each hostname separately.
CA reminder emails routinely go to a former employee’s inbox or an unmonitored alias. Point CA accounts and monitoring alerts at a shared address like ssl-alerts@yourcompany.com, never at an individual.
Paid certificates fail to auto-renew when the stored card lapses. Check billing details during quarterly reviews, or remove the failure mode entirely by switching eligible hosts to free ACME certificates.
Frequently Asked Questions
How is the SSL risk score calculated?
The score weighs five factors: days until expiry (up to 50 points — the dominant factor), whether auto-renewal is configured (20 points), whether expiry monitoring exists (10 points), how many domains share the certificate (up to 20 points), and the certificate type (up to 8 points for wildcards, which take every subdomain down with them). A score of 75+ means an outage is plausible within days.
Why does a wildcard certificate add risk?
A wildcard certificate (*.example.com) secures every subdomain with a single key and expiry date. When it lapses, your app, API, mail, and admin panels all fail at the same moment. The blast radius is the whole organisation rather than one service, which is why the calculator adds points for it.
Is auto-renewal enough on its own?
No — auto-renewal fails silently more often than people expect: expired credit cards at the CA, DNS-01 challenges broken by a nameserver change, rate limits, or a certbot timer that stopped running after a server migration. Renewal automation plus independent expiry monitoring is the reliable combination; each one catches the other’s failures.
How far in advance should I renew an SSL certificate?
Renew when roughly one third of the certificate’s lifetime remains — for a 90-day Let’s Encrypt certificate that means around day 60, which is exactly what certbot’s default does. For 1-year certificates, start the renewal process 30 days out so there is time to fix validation issues before the deadline.
What actually happens when an SSL certificate expires?
Browsers show a full-page "Your connection is not private" (NET::ERR_CERT_DATE_INVALID) warning that most visitors will not click through. API clients and mobile apps typically fail hard with TLS handshake errors, so integrations break too. High-profile outages — like the expired intermediate certificate that knocked millions of Ericsson-powered mobile users offline in 2018 — show how expensive this failure mode is.
Why are maximum certificate lifetimes getting shorter?
The CA/Browser Forum capped public certificates at 398 days in 2020 and has approved a phased reduction — roughly 200 days in 2026, 100 days in 2027, and 47 days by 2029. Shorter lifetimes limit the damage window of a stolen key, but they also make manual renewal impractical, so automation and monitoring stop being optional.
Do DV, OV, and EV certificates expire differently?
They all expire the same way, but reissuance differs: a DV certificate can be reissued in minutes with automated validation, while OV and EV certificates require organisation vetting that can take days. That is why the calculator adds risk for EV — if you discover the problem late, you cannot fix it quickly.
How do 30/14/7-day alert ladders help?
A single alert is easy to miss or snooze. A laddered schedule (30, 14, 7 days, then daily) escalates naturally: the 30-day alert is a planning nudge, the 14-day alert is a to-do, and the 7-day alert is an incident-in-waiting. CertNotify does not send a ladder: each domain has one lead time you choose (30 days on Free; 7, 14, 30, 60 days on Pro), and once the certificate is inside it you get an email every day, so a missed reminder is followed by another the next day. Paid plans add Slack and webhook delivery.
Stop Calculating — Start Monitoring
CertNotify checks your certificates every day and emails you daily once one is inside the lead time you choose, so the risk score never gets a chance to climb.