Expired certificates are one of the most common — and most avoidable — causes of client outages. They are also about to get more frequent.
Certificate lifetimes are getting shorter
The CA/Browser Forum, which sets the rules for public certificates, approved Ballot SC-081 to cut the maximum lifetime of public TLS certificates in steps (summary from DNSimple):
| From | Maximum lifetime |
|---|---|
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
Any certificate still renewed by hand once a year will soon need renewing every few months, then every few weeks. Manual tracking will not keep up.
Reminder emails are not enough
Renewal notices go to whoever bought the certificate — often a former employee or an old shared mailbox. Let’s Encrypt stopped sending expiry emails on 4 June 2025, so automated certificates that silently stop renewing give no warning at all.
The checklist
- Inventory every public hostname, not just the main website: portals, VPN, mail, remote desktop gateways, and subdomains from Certificate Transparency logs.
- Automate renewal (ACME) wherever the platform allows it.
- Monitor from outside. Check the certificate the internet actually sees, because a renewed certificate that was never installed still expires.
- Alert at more than one threshold, such as 30, 14 and 7 days.
- Check more than the date: hostname match, full chain, trusted issuer and key strength.
- Send alerts to a shared team address, never one person.
- Separate what you own from certificates a provider such as Microsoft manages for you.
Watchvera checks the certificate on every client domain and discovered subdomain on each scan — expiry, hostname, chain, trust and key strength, plus revocation on the main domain — and alerts your team at the thresholds you choose.
See how Watchvera handles this: SSL certificate monitoring.