Updated 25 October 2026 · By the Upcertain team
What happens when a certificate expires
Browsers show a full-page warning instead of your site, and most visitors leave. API clients refuse to connect and fail with TLS errors, often far from where the cause is obvious. Mobile apps that pin certificates stop working until the certificate is fixed or the app is updated.
Why automated renewals still fail
- Validation breaks. The issuer must reach your server or DNS to renew. A changed DNS provider, a new firewall rule or a moved load balancer can block it.
- The new certificate is not deployed. It renewed on one machine, but the load balancer, CDN or another server still serves the old one.
- The renewal job stopped. A cron job or timer on a rebuilt server is a silent failure like any other.
- Forgotten hosts. An old subdomain, a mail server or an internal tool that someone set up by hand years ago.
- Rate limits and account problems at the certificate issuer.
How far ahead to be warned
| Warning | Why |
|---|---|
| 30 days | Time to notice that automation failed and fix it calmly |
| 14 days | A reminder if the first one was missed |
| 7 days | Escalate: renew by hand if needed |
| 1 to 3 days | Last call, for teams with manual renewals |
Certificates from automated issuers are often renewed with about a month left, so a warning at 30 days or less fires only when automation has failed. If yours renew earlier or later, move the warnings to match.
Check more than the date
- Hostname: the certificate must cover the exact name, including
www. - Chain: a missing intermediate certificate works in some browsers and fails in API clients.
- What is actually served: check the public address, not the file on disk, so you see what visitors get.
Who should get the warning
Send expiry warnings to whoever can renew certificates, which may not be the person on call for outages. In Upcertain each alert channel chooses whether it receives SSL events, so certificate warnings can go to one email address while outages go to Slack.
In Upcertain
Every HTTPS monitor checks expiry, hostname and chain, and warns 30, 14 and 7 days ahead by default; you can choose up to five days between 1 and 90. Separate SSL monitors watch hosts you do not otherwise check. Setup is in the SSL monitor docs.