SSL RENEWAL BEST PRACTICE
Renew SSL certificates at least 30 days before expiry. Let's Encrypt certificates expire every 90 days and should be auto-renewed at 60 days. Set calendar reminders at 60, 30 and 7 days. Expired SSL breaks HTTPS and destroys user trust.
SSL Certificate Expiry Checker — Calculate Days Until Your SSL Expires
Our free SSL certificate expiry calculator tells you exactly how many days remain until an SSL/TLS certificate expires and flags critical renewal windows. An expired SSL certificate breaks HTTPS for all users, triggers browser security warnings, and can take websites completely offline. Never let a certificate expire unexpectedly — plan your renewal in advance.
Why SSL Certificates Expire
SSL/TLS certificates have a fixed validity period by design. Short lifespans ensure that:
- Compromised certificates are invalidated quickly without requiring revocation infrastructure
- Certificate authority (CA) practices and cryptographic standards remain current
- Domain ownership is re-verified regularly
As of 2024, the maximum certificate validity is 398 days (enforced by Apple, Google Chrome and Mozilla). Let's Encrypt issues certificates valid for only 90 days, encouraging automation via the ACME protocol.
SSL Certificate Renewal Best Practices
- Automate renewal — Use Certbot with Let's Encrypt for free automatic renewal. Configure auto-renewal at 60 days remaining.
- Set calendar alerts — At 60 days, 30 days and 7 days remaining
- Monitor all certificates — Use monitoring tools (UptimeRobot, Nagios, Zabbix, Datadog) to alert on expiring certificates across your estate
- Test renewal before the deadline — Never perform first-time renewal with less than 48 hours remaining
- Keep a certificate inventory — Large organisations often lose track of certificates on subdomains and internal services
What Happens When an SSL Certificate Expires?
When an SSL certificate expires, browsers immediately display a security warning page blocking users from accessing the site. Chrome shows "Your connection is not private", Firefox shows "Warning: Potential Security Risk Ahead". API integrations fail with SSL verification errors. Depending on HSTS settings, users may not be able to bypass the warning even if they wanted to. The business impact of an expired certificate — lost revenue, reputational damage and emergency after-hours work — far exceeds the effort of maintaining a renewal calendar.