TLS Certificate Expiring, the Countdown That Can Take Your Site Down

TLS certificate expiring soon. That is the flag when a site’s certificate has fewer than thirty days left, and it is the one security finding in the report with a hard deadline attached. Every other header and chain issue can wait a week without the site going dark. This one cannot, because when the certificate expires, browsers stop trusting the site and visitors stop getting through.

The urgency is built into the finding, and the severity changes as the deadline nears. Past thirty days the certificate is healthy and earns full credit. Inside thirty days the flag appears as a warning, and inside seven days it escalates, because the window has shrunk to the point where a single missed renewal can take the site offline.

What an expired certificate does

An expired certificate makes the site unreachable for most visitors until it is renewed. Browsers show a full-page security warning instead of the site, and the visitor has to click through several warnings to see anything at all, which most people will not do. Email servers refuse the connection, payment processors refuse it, and any automated client with strict validation simply stops trusting the domain.

That is why this finding matters more than its place in the list suggests. It is not a subtle optimisation or a best-practice nicety, it is a countdown to an outage, and the outage is worse than most because it looks like a security problem rather than a technical one. A visitor who sees a certificate warning does not think the site had a renewal lapse, they think the site is unsafe, and some of them never come back.

What the score does as it nears

This is the one security finding where the score reacts to time, and it is worth being precise about because most security flags work differently. A certificate with more than thirty days left earns the full twelve points of SSL credit. Inside thirty days that drops to six, and inside seven days the score genuinely falls, because at that point the risk is not hypothetical, the certificate is about to expire and take the site with it.

That last step is different from every other finding in the security section. Missing headers cost nothing when absent, they simply fail to add credit. An expiring certificate is the exception, because a certificate that lapses does active damage, so the score treats the final week as a real problem rather than a missed opportunity. The distinction matters when you read your own report, a low security score with an expiring certificate is a countdown, not a judgement.

Renew now, then make it automatic

The immediate fix is to renew the certificate. Most authorities let you reissue at any point in the validity window, so renewing with thirty days left is normal and does not waste anything, the new certificate simply starts when the current one ends. The renewal path depends on where the certificate came from, a control panel, a hosting provider, or a certificate authority, and all of them have a renew button that takes minutes.

The real fix is automation, because manual renewal is how certificates lapse. If the certificate comes from a service that supports ACME, the protocol behind automated certificate management, set up auto-renewal so the certificate refreshes itself before it expires. The renewal cron is the part that silently stops, so after setting it up, confirm it fires, because many outages come from a renewal job that ran once and never ran again.

# certbot dry-run confirms the renewal path works end to end
certbot renew --dry-run

# check the cron that runs it is actually scheduled
crontab -l | grep certbot

If the site sits behind a CDN or a reverse proxy, check which certificate the visitor receives. A site can renew its origin certificate perfectly and still serve an expiring certificate at the edge, because the CDN holds its own copy. The certificate the report checks is the one the visitor gets, so after any renewal, confirm the public certificate is the new one, not a stale copy sitting in front of the origin. The server check tool shows the certificate a domain serves, including its expiry date, which makes it a fast way to check the edge copy against the origin.

Watching the countdown clear

Run another Enterramon test after the renewal and the finding clears, because the report reads the certificate the site serves. The score recovers to the full SSL credit, and the countdown that was driving it disappears. If the certificate is now automated, the finding should not come back, which is the real test of the fix, not the renewal itself but the renewal that keeps happening without anyone remembering to do it.

One note on reports like this one. An expiry finding is a snapshot of a moment, and by the time a reader finds the article the specific certificate in the screenshot may well have been renewed. The lesson travels anyway, because every certificate has a countdown, and the question the finding asks is whether yours is being watched by a human or handled by automation.