Two dates that take the whole site down: certificate and domain expiry

Why auto-renewal still fails, what changes as certificate lifetimes shrink to 47 days, how a domain actually lapses, and the checks that catch both in time.

Infrastructure · Published: 23 September 2026 · 5 min read · Дмитрий Орлов

Most outages are partial: one page is slow, one form is broken. Two events are total. When the TLS certificate expires, every browser shows a full-screen warning. When the domain registration lapses, the name stops resolving at all. Both are scheduled months in advance, and both still catch teams by surprise.

"But we have auto-renewal"

ACME clients such as certbot renew Let's Encrypt certificates on their own, which is exactly why nobody watches them. The failures we see are rarely in the client itself:

• DNS changed. The domain moved to a new host or CDN, and the HTTP-01 challenge now lands on a server that knows nothing about it.
• A firewall blocks port 80. Someone closed plain HTTP "for security"; the HTTP-01 challenge needs it.
• A redirect on /.well-known/acme-challenge/. A catch-all rule sends it to the homepage or a login page, and validation fails.
• The cron job died with the old server. The site was migrated, the renewal timer was not.
• Renewed on disk, never loaded. certbot wrote a new file, but nginx was not reloaded and keeps serving the old certificate from memory.
• Another copy elsewhere. A CDN or load balancer terminates TLS with its own certificate, uploaded by hand two years ago.

Lifetimes are shrinking

CA/Browser Forum ballot SC-081 cuts the maximum certificate lifetime in steps: 200 days from March 2026, 100 days from March 2027, 47 days from March 2029. Renewing by hand once a year is already over; by 2029 it would mean a manual change every month or so. Automation is no longer optional, which makes monitoring that automation the actual job.

A valid date is not enough

Two problems pass a date check and still break clients. A missing intermediate certificate: desktop browsers often fetch it themselves, while Android, curl and API clients fail. And a weak signature: anything signed with SHA-1 is rejected outright; look for sha256WithRSAEncryption or an ECDSA equivalent.

How a domain actually lapses

Domains rarely expire through neglect alone. Typically the card on file at the registrar has expired, and the renewal notices go to the mailbox of an employee who left in 2021.

What follows depends on the TLD and registrar, but the usual sequence is: the expiry date passes; the registrar may set clientHold, which pulls the domain out of DNS; an auto-renew grace period runs, often up to 45 days, when renewal is still cheap; then redemption, around 30 days, when it costs a restoration fee; then pendingDelete, about five days, when nothing can be done. After that the name is released, and drop-catching services register valuable names within seconds.

Two more things belong in the same review. Transfer lock (clientTransferProhibited) should be on, so the domain cannot be moved away quietly. And nameservers should be at least two, ideally on separate networks or providers.

Check it yourself

What the server actually presents:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -enddate -issuer

The -servername flag matters: without SNI you may get the default certificate instead of the one for your host. For the domain, RDAP is the structured successor to WHOIS:

curl -s https://rdap.org/domain/example.com

Look at the expiration event, the registrar and the status list.

Monitoring that works

• Alert at 30, 14 and 7 days. One notice is easy to miss; three escalating ones are not.
• Check from the outside. Test what a browser receives, not the file on disk. That catches the missed reload, the CDN copy and the broken chain.
• Check every hostname. www, api, mail and the apex often carry different certificates from different places.

A SiteScan report shows days left on the certificate, its issuer and signature algorithm, days left on the domain, the registrar, registry status codes and whether transfer lock is on. Watching a site re-checks them on schedule, so the reminder arrives while it is still routine.

Check-list

1. The certificate on every hostname has more than 30 days left.
2. The full chain is served; the signature is SHA-256 or better.
3. Renewal is automated, and the reload after it is too.
4. The ACME challenge path is reachable over port 80 without redirects.
5. The registrar has a valid card and a shared, current email address.
6. Domain auto-renew and transfer lock are on.
7. There are at least two nameservers.
8. Alerts fire at 30, 14 and 7 days.