Certificate expiry and renewal

Every certificate has an expiry date, and that is on purpose. A short lifetime limits the damage if a key is stolen or a certificate is issued by mistake. Revocation has never worked well, so expiry is the main safety net. The cost is that someone must renew the certificate every time. If nobody does, the site stops working.

The big idea: lifetimes keep getting shorter

The CA/Browser Forum voted in 2025 to cut the maximum lifetime of public TLS certificates in steps.

Let's Encrypt has issued 90-day certificates since it launched in 2015, and it has announced a move to 45-day certificates.

Walking through the arithmetic

With a 90-day certificate renewed at two-thirds of its life, renewal runs about 60 days after issue. That leaves 30 days to notice and fix a broken renewal. With a 47-day certificate, the same rule renews at about day 31 and leaves about 16 days. A human cannot renew every 47 days across hundreds of hosts, so automation becomes mandatory.

90-day cert, renew at 2/3 life  → renew at day 60 → 30 days to fix a failure
47-day cert, renew at 2/3 life  → renew at day 31 → 16 days to fix a failure

What expiry has cost

• December 2018. An expired certificate in Ericsson software took down mobile data for O2 and SoftBank customers for most of a day.
• February 2020. Microsoft Teams went down for hours because an authentication certificate expired.
• 30 September 2021. The old IdenTrust DST Root CA X3 certificate expired. It had cross-signed Let's Encrypt's roots, so up-to-date clients were fine. Older Android devices, older OpenSSL versions and embedded clients with stale trust stores failed against many sites.

The third case shows that expiry can happen in the chain or in the client's trust store, not only in your leaf certificate.

The playbook

1. Automate issuance and renewal. Use ACME with cert-manager or certbot, or a cloud's managed certificates. Renew at two-thirds of the lifetime, not on the last day.
2. Monitor expiry separately from the renewal system. An outside probe that alerts at 21 and 7 days remaining catches renewals that fail silently, such as a DNS-01 challenge broken by a credentials rotation.
3. Inventory every certificate, including the forgotten ones: internal CAs, mTLS client certificates, SAML signing certificates, and certificates on load balancers configured by hand.
4. Test the full chain from real clients, especially the old clients you still support.

Checking expiry from the command line

This script reports whether a host's certificate expires within 14 days. -checkend is an OpenSSL option, so it works on macOS and Linux.

host=api.example.com
echo | openssl s_client -connect "$host:443" -servername "$host" 2>/dev/null \
  | openssl x509 -noout -checkend $((14 * 86400)) \
  && echo "$host: OK for 14 more days" \
  || echo "ALERT: $host expires within 14 days"

Output when the certificate is fine (illustrative):

Certificate will not expire
api.example.com: OK for 14 more days

Output when it is close to expiry (illustrative):

Certificate will expire
ALERT: api.example.com expires within 14 days

Common mistakes

• Renewing on the last day. One failed attempt leaves no time to fix it.
• Monitoring only through the renewal system. If the renewal breaks, the monitor breaks with it.
• Forgetting internal certificates. Internal CAs, mTLS and signing certificates expire too.
• Fixing an expiry error by disabling verification. The site may come back, but authentication is gone. Fix the certificate or the chain.

Check yourself

1. A certificate has a 90-day lifetime. When should automated renewal run, and why? At about two-thirds of the lifetime, around day 60, so there are about 30 days to fix a failure.
2. A check reports OK but the site fails for some clients. What should you look at? The chain or the trust store. The leaf may be fine while an intermediate or a root is wrong for those clients.

Key takeaways

• Certificates expire on purpose, and lifetimes are shrinking toward 47 days.
• Expired certificates have taken down large services, sometimes through the chain or the client's trust store.
• Automate renewal, renew early, and monitor expiry from outside the renewal system.
• Inventory every certificate, including internal ones, and test chains from real clients.

Further learning

Let's Encrypt's announcement on moving to 45-day certificates gives the timeline and the reasons for the change.

Let's Encrypt: Decreasing certificate lifetimes to 45 daysLet’s Encrypt will be reducing the validity period of the certificates we issue. We currently issue certificates valid for 90 days, which will be cut in half to 45 days by 2028. This change is being made along with th…Let's Encrypt

Next, read terminating TLS and mTLS to see where certificates are installed in a production system.