Never Let an SSL Certificate Expire Again

Few outages are as avoidable — or as embarrassing — as an expired SSL certificate. When a cert lapses, every visitor sees a full-page security warning, and search engines flag your site as unsafe. The worst part? It was on a calendar the whole time.

Why certificates still expire

• Auto-renewal silently broke. An ACME client failed weeks ago and nobody noticed.
• A manual cert was forgotten. Someone bought a 1-year cert and moved on.
• A subdomain slipped through. The main domain renews fine, but an API host doesn't.

Check it from the command line

# See when a certificate expires
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates

Monitor expiry, not just uptime

Uptime checks won't save you here — the cert is valid right up until the moment it isn't. You need a monitor that reads the certificate and warns you days in advance. Set the warning window generously (14–30 days).