How to actually stop an SSL certificate from expiring on you
Every expired-certificate outage I've come across had the same root cause, and it wasn't technical. It was a belief. Everyone assumed something else was watching. Auto-renewal "had it." The last person who set it up left. And then one Tuesday the browser starts screaming at customers, and three people are on a call trying to remember how the renewal even works.
So let's be honest about the thing everyone leans on.
"But it renews automatically"
Mostly, yes. Let's Encrypt and most decent hosts renew on their own, and for long stretches you'll never think about it. That's exactly why it bites — you stop watching a thing that works, right up until it doesn't.
Here's the catch: the renewal runs on your server. So anything that quietly breaks that job breaks the renewal, and nobody gets a memo:
- You migrate to a new box and the renewal cron doesn't come with it.
- Someone moves a DNS record during an unrelated change, and the validation that renewal depends on starts failing.
- The site gets rebuilt on a new stack and the old renewal setup is just… gone.
- An API token expires, or you hit a rate limit, and the renewal silently gives up.
None of those throw an error you'll see. The certificate keeps counting down on its original schedule, indifferent to the fact that its replacement isn't coming. The failure is invisible until the exact moment it's very, very visible.
The fix isn't more automation. It's a second pair of eyes.
People's instinct after an expiry is to add another automated renewal, or a calendar reminder. The calendar reminder gets snoozed into oblivion. The second automation is one more thing that can silently break.
What actually works is boring: something that looks at the live certificate from the outside, every day, and makes noise before it expires — not after. It doesn't care how the renewal is supposed to happen. It just watches the real cert the world sees and tells you "this expires in 12 days" while 12 days is still plenty of time to fix a cron job over coffee.
Ways to check, from quick to hands-off
| Method | Good for | The catch |
|---|---|---|
| Click the padlock in your browser | A one-off gut check | You have to remember, per site, forever |
openssl s_client -connect yourdomain.com:443 </dev/null 2>/dev/null | openssl x509 -noout -enddate | Scripting, one server | Still a thing you run, not a thing that runs |
| An external monitor | Never thinking about it again | None worth mentioning — this is the point |
The browser and openssl answer "is it fine right now?" A monitor answers the only question that actually saves you: "will it still be fine next week, and will I hear about it if not?"
One habit, and you're done
Point a monitor at your domains once. Set the warning window somewhere sane — 30 days to fix it calmly, with 14- and 7-day backstops for when you're busy. Then forget about certificates, on purpose, because now something else is holding that thread. That's the whole trick. Not vigilance. Delegation to a thing that never gets bored.
If you also want to catch the security headers and DMARC records that drift the same silent way, watch those in the same place — they fail exactly like certificates do, quietly.
Let something else watch the countdown
Perimeter checks your certificate every day and emails you well before it expires — plus your headers and DNS, in case those slip too. Run your domain free first, no signup.
Monitor it continuously → · from $29/mo