Why certificates still expire
- Some were installed by hand: firewalls, VPN and RDP gateways, NAS units, printers, on-premises mail servers and appliances.
- Auto-renewal fails quietly: a DNS change, a closed port 80, or an expired API token stops it and nobody reads the log.
- Renewed but not deployed: the new certificate sits on one server while the load balancer or proxy still serves the old one.
- The renewal goes to someone's mailbox, and that person has left.
Certificate lifetimes are getting shorter
The CA/Browser Forum, which sets the rules browsers enforce, has voted to cut the maximum lifetime of public certificates in steps: 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. Manual renewal stops being practical; automation and monitoring become the only way to keep up.
A routine that catches them
- Inventory every certificate per customer: public websites, plus everything with a login page on HTTPS (firewall, VPN, remote desktop gateway, mail, NAS, hypervisor management).
- Automate renewal wherever the device supports ACME (Let's Encrypt and other authorities).
- Monitor what is actually served, from outside: check the certificate a visitor receives, not the renewal log. That also catches the renewed-but-not-deployed case.
- Alert early: 30 days ahead for hand-installed certificates, 14 days for automated ones that should have renewed already.
- Check the whole chain and the names, not just the date: a missing intermediate certificate or a name that is not on the certificate breaks things just as badly.
- Record who owns each certificate and how it is renewed.
Check one now
The free SSL certificate checker shows the issuer, expiry date, days left, whether browsers trust it and whether it covers the name. TechSavve RMM checks certificates for every customer automatically and tells you before one runs out.