Security
SSL certificates: how to avoid expiries
An expired certificate blocks your website with a security warning and breaks your APIs. Here's why it still happens, even with automatic renewals, and how to prevent it.
UptimeAnchor team · · 6 min read
Few problems are as avoidable as an expired SSL certificate, yet it happens all the time, even to very large companies. The result is always the same: browsers show a full-screen warning, visitors leave and the integrations calling your APIs start failing.
Why certificates still expire
With free, automatically renewed certificates, many people assume the problem is solved. In reality automatic renewal is a process like any other, and it can break silently.
- The renewal job no longer runs after a server migration.
- Domain validation fails because the DNS or firewall configuration changed.
- The certificate is renewed, but the web server isn't reloaded and keeps serving the old one.
- Purchased certificates valid for a year, whose renewal depends on someone who has changed roles.
- Forgotten subdomains: the admin panel, the internal API, the old test environment.
Certificate lifetimes are getting shorter
The industry is moving towards certificates with ever shorter validity. This improves security, but it multiplies the number of renewals and therefore the chances of something going wrong. Relying on memory or a calendar reminder is no longer sustainable.
Monitor the certificate from the outside
The only reliable way to know whether a certificate is valid is to check it the way a visitor sees it: from the outside, over a real connection. UptimeAnchor does this automatically on every HTTPS monitor: at each check it reads the issuer and expiry date and sends reminders 30, 14, 7 and 1 day before expiry.
A checklist to get it right
- Inventory every domain and subdomain served over HTTPS, including exposed internal ones.
- Create an HTTPS monitor for each one, even rarely visited ones.
- Send SSL reminders to someone who can act, not to an inbox nobody reads.
- After every renewal, check that the new certificate is actually being served.
- Add domain expiry monitoring too: an expired domain makes even the most valid certificate useless.
An expired certificate isn't a hard technical problem: it's a visibility problem. With the right monitoring it becomes a calm reminder weeks in advance, instead of a Saturday-morning emergency.