What is TLS certificate expiry?
TLS certificate expiry is the date and time in a certificate's notAfter field after which browsers, apps and API clients reject it, so HTTPS connections fail with an error. Public certificates have short lifetimes, 90 days for Let's Encrypt, so renewal must be automated and expiry monitored on every endpoint that serves the certificate.
Why TLS certificate expiry matters
An expired certificate is a full outage for every client, and an embarrassing one, because it was predictable months in advance. It usually happens when automated renewal fails silently, or when a manually bought certificate's reminder went to someone who has left.
Lifetimes are getting shorter: the CA/Browser Forum has voted to cut the maximum lifetime of public TLS certificates in stages to 47 days by 2029, which makes manual renewal impractical.
How to measure TLS certificate expiry
days left = notAfter − now certbot default: renew when 30 days or fewer remain
Worked example
A Let's Encrypt certificate was issued on 1 August 2026 and expires on 30 October 2026. Today is 10 October 2026.
- Lifetime = 1 August to 30 October = 90 days.
- Days left = 30 October − 10 October = 20 days.
- Certbot would have started renewing on 30 September (30 days before expiry), so 20 days left means renewal has been failing for about 10 days.
Result: An alert at 14 days still leaves two weeks to fix the renewal, which often fails because a firewall blocks the HTTP-01 challenge or DNS has changed.
Common mistakes
- Monitoring one endpoint only. A CDN, load balancer or mail server may still serve the old certificate after the main site renewed.
- Renewing without reloading. Certbot can renew the file while nginx keeps serving the old certificate from memory until it reloads.
- Missing intermediates. A chain without the intermediate certificate works in some browsers and fails in curl and API clients.
- Alert thresholds that are too short. A 3-day warning leaves no time if the fix needs someone else.
How Vigil handles TLS certificate expiry
- Every Vigil Uptime monitor on an HTTPS URL reads the certificate actually served and alerts before expiry, 14 days ahead by default and configurable per monitor; broken chains and hostname mismatches fail the check outright.
- The weekly security scan grades TLS versions, HSTS, CSP and cookie flags from A+ to F and alerts when the grade drops.
- Check any host now with the free SSL certificate checker; the guide on monitoring SSL certificates has the openssl commands.
TLS certificate expiry: frequently asked questions
What happens when a TLS certificate expires?
Browsers show a full-page warning, and most API clients, mobile apps and webhook senders refuse to connect. To users the site is down.
How early should I alert?
With automated 90-day certificates, 14 days catches failed renewals with time to spare. For manually bought certificates, 30 days or more, because purchase and validation take time.
How do I check expiry from the command line?
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate prints the notAfter date of the certificate the server sends.