TLS certificate expiry

How many days are left on the certificate the site is serving. Browsers refuse the site outright the moment it expires, so it is worth knowing about long before the last week.

• Help center

A TLS certificate is valid only for a fixed window. Since March 2026 a public certificate can live at most 200 days, many (Let's Encrypt among them) last 90 days or less, and the limit keeps shrinking. When the end date passes, browsers show a full-page warning instead of the site, API clients and webhooks fail, and crawlers stop fetching pages. Nothing on the server has to break; the date alone is enough.

How SiteScan reads it

The scan takes the certificate the site actually serves over HTTPS and counts the whole days left until it expires. More than 30 days is green, 30 days or fewer is amber, and a date in the past is red.

What to do

• Let an ACME client renew automatically (certbot renew on a systemd timer or cron) and reload the web server afterwards: a new file on disk that the server never loaded still expires.
• Amber on an automated setup usually means renewal has been failing quietly. Check the client's log, the HTTP or DNS challenge, and whether a CDN or load balancer serves its own copy of the certificate.
• Keep both dates in monitoring: read why auto-renewal still fails and check the domain registration expiry too.