SSL Certificate Risk Calculator

Every SSL/TLS certificate has a hard deadline baked into it, and the moment it passes, browsers stop trusting your site — no grace period, no warning banner for visitors, just a full-page security error. Expiry outages are unusual among production incidents in that they are 100% predictable: the date is known months in advance. They still happen constantly, because the renewal depends on a chain of small things going right — a payment method on file at the CA, a DNS record that still resolves, a cron job that survived the last server migration, a person who still works at the company reading the reminder email.

This calculator turns those failure modes into a single 0–100 score. It is deliberately weighted so that time remaining dominates: a perfectly automated setup with 3 days left is still an emergency, while a manual process with 300 days of runway is merely a task. The remaining points capture how wide the blast radius would be (wildcard and multi-domain certificates take many services down at once) and whether anything would warn you before the deadline.

The stakes keep rising as maximum certificate lifetimes shrink. Public certificates were capped at 398 days in 2020, and the CA/Browser Forum has approved a phased reduction to roughly 47-day certificates by 2029. In that world a renewal happens for every domain every few weeks — which is exactly why the two configuration checkboxes in this calculator (auto-renewal and monitoring) are worth 30 risk points between them.