SSL certificate expiry

Every TLS certificate carries a fixed expiry date. The instant it passes, browsers stop connecting — not a warning, a hard refusal with an interstitial that most visitors will not click through. The failure is total, affects everyone simultaneously, and happens at a moment that was knowable for months.

That is what makes it the most preventable outage in the industry and one of the most common. Automation has helped enormously, but the failure modes did not disappear: a renewal hook that stopped firing after a server rebuild, a certificate renewed on disk but never reloaded by the running process, an ACME challenge broken by a redirect rule, a certificate on a load balancer that nothing automated ever touched. Every one of those looks fine until the day it does not.

Certificate expiry checks belong at multiple horizons rather than one. Thirty days out is a ticket, seven days out is a real alert, and one day out is an incident, because a failed renewal usually needs a person and the last day is not when you want to discover that. Certificate lifetimes across the industry are getting shorter, which means renewal runs more often and there are more chances for it to quietly stop.

Worth checking separately from expiry: whether the certificate actually matches the hostname, whether the chain is complete, and whether it was replaced by something unexpected. A valid certificate for the wrong name fails just as completely.