Certificate expiry is the outage you can always avoid

An expired certificate does not take the server down — it takes the visitors away. Modern browsers show a full-page warning before the site loads, and most people leave rather than click through it.

The three ways it happens

1. Auto-renewal silently stopped working. The most common cause. Certbot or acme.sh renews on a schedule, but if the DNS record moved, the challenge path changed, or the web server config was edited, renewal starts failing quietly — and nobody notices for 60 days.
2. Nobody is watching the renewal job. Renewal runs on the server; if it fails it usually emails root, and root's mail often goes nowhere.
3. A single-name certificate on a multi-name site. The apex renews and the www hostname does not, or a subdomain used by an app was missed.

The five-minute routine

• Check the expiry date today, and again on any day you change DNS or the web server config.
• Set the renewal to run at 30 days remaining, not 7. Thirty days gives you a month of noticed failures before anyone sees a warning page.
• Watch the actual date, not the job status: a renewal job that reports success while the certificate stays unchanged is a classic silent failure.
• Check every hostname you serve, including www and any subdomains that answer on 443.

What good looks like

A healthy site always has 60+ days left on every hostname. If you see 20 days, you are one failed renewal away from a warning page. Setting up a scheduled check means you hear about it from us rather than from a customer.

---

Ready to try it? Open the tool.