How far in advance should I be warned about an expiring certificate?

Thirty days is comfortable for certificates that are renewed by hand or through a client's IT department, because it leaves time for a ticket and an approval. For automatically renewed Let's Encrypt certificates, a warning inside the last few weeks usually means auto-renewal has already failed, since Certbot renews when about 30 days remain.

Does an expired SSL certificate hurt SEO permanently?

A short outage fixed within hours generally has no lasting effect. The risk grows with duration: after several days of failed fetches, Google reduces crawling and can drop URLs, which then need to be recrawled once the site is back.

Can a certificate be invalid before it expires?

Yes. A hostname missing from the Subject Alternative Names, an incomplete chain, or a certificate revoked by the issuer all trigger browser warnings while the expiry date is still in the future.

Do paid certificates still need monitoring?

Yes, arguably more. Paid certificates typically last a year and are renewed manually, often by someone at the client who has since left, so there is no automated job to fall back on.

How much does Deltio cost?

Starter is £24 a month, or £20 a month billed annually, for up to 50 sites. Professional is £49 a month (£41 annually) for up to 200 sites, and Enterprise is £119 a month (£99 annually) for up to 500. Every plan comes with a 14-day free trial.

← Back to the blog

SSL Certificate Expiry Monitoring: Stop Finding Out From a Client

SSL certificate expiry monitoring is the automatic, repeated check of how many days a site's TLS certificate has left, with an alert sent early enough to renew it. When a certificate expires, browsers replace the page with a full-screen warning, so forms, logins and checkouts stop working and traffic falls away almost immediately.

Expiries rarely happen on the flagship site everyone watches. They happen on the site inherited from a previous agency, on a subdomain nobody listed, over a weekend. Too often the client notices before the agency does.

What visitors and crawlers get

In Chrome the page shows "Your connection is not private" with the error code NET::ERR_CERT_DATE_INVALID. Firefox shows "Warning: Potential Security Risk Ahead" with SEC_ERROR_EXPIRED_CERTIFICATE. Most people leave. If the site sends a Strict-Transport-Security header (HSTS), browsers do not even offer a way to proceed, so the site is simply unreachable for returning visitors.

Analytics goes flat, because the page never loads and the tracking script never runs. Payment and lead forms fail. Server-to-server calls, such as webhooks from a payment provider, reject the certificate and usually log the error somewhere nobody is looking. Googlebot sees fetch errors, and if the problem lasts days rather than hours, crawling slows down and pages can drop.

How certificates expire despite auto-renewal

Let's Encrypt certificates last 90 days, and renewal is normally a scheduled job run by Certbot or the hosting panel. It fails in a handful of predictable ways.

The job itself breaks. A package upgrade, a changed Python environment or a full disk makes certbot renew exit with an error that ends up in /var/log/letsencrypt/ and nowhere else. Let's Encrypt also ended its expiration reminder emails in 2025, so the warning many people used to rely on no longer arrives.

Validation stops passing. The HTTP-01 challenge needs /.well-known/acme-challenge/ to be reachable on port 80. A new redirect rule, a WAF or a firewall change can block it. For DNS-01, moving DNS to another provider breaks the API credentials the renewal was using.

The certificate renews but is never loaded. Nginx and Apache keep serving the certificate they loaded at start-up until they are reloaded. Certbot handles this with a deploy hook such as --deploy-hook "systemctl reload nginx"; if that hook was never set, the file on disk is fresh while visitors get the expired one.

Edge and origin disagree. When Cloudflare or a load balancer terminates TLS, there are two certificates with two expiry dates. The one visitors see is at the edge, but an expired origin certificate breaks the connection behind it when full strict mode is on.

Subdomains are forgotten. A certificate for example.com and www.example.com does not cover shop.example.com or staging.example.com, each of which may have its own certificate and its own renewal job.

You can run certbot renew --dry-run to test the renewal path without replacing anything.

Checking the date yourself

In a browser, click the icon to the left of the address bar, open the certificate details and read the "Expires on" or "Valid to" date.

On the command line:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -issuer

This prints notBefore, notAfter and the issuer. Always include -servername; without it, a server hosting several sites on one IP may return its default certificate rather than the one for your hostname.

While you are there, check two more things. The issuer should be the one you expect, since a change often means hosting or the CDN was reconfigured. And the chain should be complete: a missing intermediate certificate or a hostname not listed in the certificate's Subject Alternative Names produces the same browser warning as an expiry, even with months left.

Once per site this takes a minute. Across thirty clients, their subdomains and a few staging environments, it becomes a job that gets skipped in the busy weeks. The website monitoring checklist for agencies covers the other recurring checks that suffer the same fate.

SSL monitoring in Deltio

Deltio checks the certificate on every site you add, shows the days remaining and the issuer in the dashboard, and alerts you by Slack and email ahead of expiry and when a certificate is not valid. Domain expiry is checked in the same place, which matters because a lapsed domain takes the certificate, the site and email down together. Uptime, robots.txt and sitemap changes run on the same account, so SSL is one line in a broader picture of each client site rather than a separate tool, the approach described in how to monitor client websites for changes. An expired certificate is effectively downtime, which is also why it features in our UptimeRobot alternative comparison.

Frequently asked questions

How far in advance should I be warned about an expiring certificate?: Thirty days is comfortable for certificates that are renewed by hand or through a client's IT department, because it leaves time for a ticket and an approval. For automatically renewed Let's Encrypt certificates, a warning inside the last few weeks usually means auto-renewal has already failed, since Certbot renews when about 30 days remain.
Does an expired SSL certificate hurt SEO permanently?: A short outage fixed within hours generally has no lasting effect. The risk grows with duration: after several days of failed fetches, Google reduces crawling and can drop URLs, which then need to be recrawled once the site is back.
Can a certificate be invalid before it expires?: Yes. A hostname missing from the Subject Alternative Names, an incomplete chain, or a certificate revoked by the issuer all trigger browser warnings while the expiry date is still in the future.
Do paid certificates still need monitoring?: Yes, arguably more. Paid certificates typically last a year and are renewed manually, often by someone at the client who has since left, so there is no automated job to fall back on.
How much does Deltio cost?: Starter is £24 a month, or £20 a month billed annually, for up to 50 sites. Professional is £49 a month (£41 annually) for up to 200 sites, and Enterprise is £119 a month (£99 annually) for up to 500. Every plan comes with a 14-day free trial.