SSL Certificate Expiry: The Silent Killer of Website Trust

Your SSL certificate has an expiry date. When it passes, browsers immediately block visitors from reaching your site — displaying a full-page "Your connection is not private" warning that most users will not click through.

No warning email. No grace period. Just a hard stop.

It happens more than you'd think. Automated certificate renewals fail silently. DevOps rotations mean no one remembers who owns the renewal. A domain moves to a new host and the old cert isn't migrated. The result is always the same: your site is effectively offline, and you find out from a panicked customer message.

Why SSL Expiry Is Different from Downtime

Regular downtime is usually loud. Your server crashes, your hosting provider sends an alert, your analytics spike. SSL expiry is quiet. Your infrastructure is running fine. Your monitoring ping returns 200. But every real visitor — on Chrome, Safari, Firefox — is getting a red warning page.

Standard uptime monitors that just check HTTP status codes won't catch this. You need something that actually checks the certificate's validity and remaining days.

What to Watch For

There are a few SSL failure modes beyond simple expiry:

• Expired certificate — the most common. Automated renewal failed at some point.
• Certificate/domain mismatch — you moved to a new domain or subdomain but the cert wasn't updated.
• Broken certificate chain — your cert is valid but intermediate certs weren't installed correctly. Affects some browsers and devices.
• Self-signed certificate — common in development, catastrophic if accidentally deployed to production.

The 30-Day Rule

Most security teams use a 30-day warning window. If your certificate has fewer than 30 days remaining, it's in an "at risk" state — something should be happening to renew it. Under 14 days is a high-priority incident. Expired is a full outage.

Page Canary checks your SSL certificate and domain every day and warns you well before either expires — before your users hit the warning page.

How to Renew Before It Expires

If you're using Let's Encrypt with Certbot, renewal is automatic but the cron job can silently fail. Verify it with:

certbot renew --dry-run

If you're on a managed host (Cloudflare, Vercel, Netlify), SSL renewal is handled for you — but only for the domains they manage. Custom domains added manually may not auto-renew.

If you manage your own certs, set a calendar reminder 45 days before expiry. Or better: stop relying on calendar reminders and let automated monitoring handle it.

Set It and Forget It

The best SSL strategy is one you don't have to think about. Automated certificate monitoring should alert you the moment a cert drops below your threshold — not the moment it expires.

Try the free Page Canary scan to see your current SSL status, or start daily monitoring to get alerted before expiry ever becomes a problem.