Home / Knowledge hub / Certificate expiry
Knowledge hub
Certificate expiry
A TLS certificate running out, which breaks trust and often the whole site.
What it means
A TLS certificate is a digital document that proves a server owns its domain name, and every certificate has an end date. Certificate expiry is the moment it passes. After that, browsers and API clients no longer trust the server and refuse to connect.
The failure is abrupt. One minute the site works. The next, visitors see a full-page warning, mobile apps fail with a network error, and integrations that call your API stop, because the certificate checks are working exactly as designed. Nothing was hacked; a date simply passed.
Why it matters
An expired certificate is one of the most common avoidable outages. It costs sales, it breaks partner integrations, and it makes a business look careless. Large, well-run companies have had it happen. It does not mean an attack, but customers cannot tell the difference.
Lifetimes are getting shorter. Public certificates already have limited maximum lifetimes, free services such as Let's Encrypt issue 90-day certificates, and the industry has agreed to shorten the maximum further. Renewal by hand becomes less workable each year. See TLS for the wider picture.
How it shows up
Certificates are everywhere: the main site, the API domain, internal services, a load balancer, a third-party vendor's subdomain, and client certificates used for mutual TLS. The ones that expire unnoticed are the forgotten ones, held by someone who left or on a service nobody owns.
The fix is to automate. Use ACME-based renewal where you can, keep an inventory of every certificate with an owner, monitor expiry dates and alert weeks ahead, and test that the new certificate is actually installed. Never respond to an error by turning off verification in code. That swaps an outage for a quiet man-in-the-middle risk.
Questions people ask
Certificate expiry, answered
What happens when a certificate expires?
Browsers show a warning and block most visitors. API clients, mobile apps and other servers refuse the connection and throw errors.
Data is not exposed by the expiry itself, but service is effectively down for anyone who checks properly.
How do we stop certificates expiring?
Automate renewal, keep an inventory, and monitor expiry dates with alerts that reach a team, not one person. Test renewal before the deadline, not after.
Include internal and client certificates in the list.
Why are certificate lifetimes getting shorter?
Shorter lifetimes limit how long a stolen or mis-issued certificate can be abused, and they push everyone towards automation. The CA/Browser Forum sets the maximum for public certificates.
Check the current rules there rather than relying on a fixed number.
Is an expired certificate a security vulnerability?
It is mainly a reliability and trust problem. But the usual response, ignoring warnings or disabling checks, creates real exposure.
Treat the warning as a signal to fix the certificate, not to bypass it.
Does a valid certificate mean the site is safe?
No. It shows the connection is encrypted and that the server controls the domain. It says nothing about whether the application behind it is free of flaws.
Attackers also use valid certificates on their own sites.
Sources
Where this comes from
Related
Terms that sit next to this one
TLS
The protocol that encrypts traffic between a browser and a server.
mTLS
A connection where both client and server prove who they are with certificates.
HTTPS
The encrypted web protocol, and the minimum for anything with a login.
Man-in-the-middle attack
Someone sitting between two parties, reading or changing what passes between them.
Asset inventory
A current list of the systems, apps and data you are responsible for.
Who owns each certificate?
A certificate keeps traffic private but says nothing about the app behind it. We test what is behind the padlock and report what we actually exploited, with proof. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.