Your SSL certificate is expiring: automate it before it bites
Expiry is not a soft failure
Most things that go wrong with a website degrade gracefully — a slow page, a broken image. An expired certificate does not. The moment it lapses, browsers throw a full-screen warning telling visitors your site is not secure and steering them away. There is no partial outage and no quiet fallback: your site is effectively down for everyone, and it looks alarming while it is.
The frustrating part is that this is one of the most predictable failures there is. You know the exact date in advance. And teams still get caught by it.
Why certificates expire on purpose
The short lifetime is a feature, not an oversight. Shorter validity limits how long a stolen or mis-issued certificate is useful, and forces the regular re-validation that keeps the web's trust system honest. Certificate lifetimes have been getting shorter over time, not longer — which means renewal happens more often, and any manual process you rely on breaks more often too.
Why manual renewal keeps failing
Manual renewal asks a human to remember something months in the future, reliably, forever. That fails for ordinary reasons:
- The person who set it up left, or changed roles.
- The reminder landed during a busy week and got dismissed.
- The calendar entry was for the wrong cert, or there were several and one was missed.
- Everyone assumed someone else was handling it.
None of these are negligence. They are just what happens to any process that depends on memory across long intervals.
How to automate it
The goal is to remove the human from the renewal path entirely:
- Use an ACME client. A free certificate authority like Let's Encrypt issues short-lived certs that a client such as
certbotrenews automatically on a schedule, well before expiry. Set it up once and it runs unattended. - Let your platform handle it. Most managed hosts, PaaS platforms and CDNs — the kind of place a lot of modern apps deploy to — provision and renew certificates for you with nothing to configure. If you are on one, this is largely solved already.
- Confirm auto-renewal actually runs. Automation can silently stop — a renewal hook breaks, a permission changes. Do not assume; verify it renewed.
Monitor expiry as a safety net
Even with automation, you want a separate check watching the actual expiry date of the certificate your site is serving — independent of whatever is supposed to be renewing it. That way a silent automation failure surfaces as an early warning with weeks to spare, instead of as a full-page browser error on a Monday morning. Monitoring is the backstop that turns 'we automated it' into 'we know it is working'.
Check your certificate now
You cannot tell when your certificate expires by glancing at the padlock, and you certainly cannot tell whether renewal is quietly broken. An automated scan reads your live certificate, reports exactly when it expires and flags configuration problems alongside it. Scan your site and find out how much runway your certificate has left before it bites.