SSL certificates: shorter lives, no reminders, and how not to get caught out
What a certificate says, how a browser checks it, why certificates now last 200 days and will soon last 47, and what to watch so an expired one never reaches your visitors.
An SSL certificate is what lets a browser trust that it's talking to your site, and encrypt everything sent between the two. When one expires or doesn't match, visitors don't get a slightly worse page - they get a full-screen warning, and most of them leave.
(The protocol has been called TLS for years. Everyone still says SSL, so this post does too.)
What a certificate says
A certificate is a small signed document. The parts that matter day to day are:
- The names it covers -
acme.com,www.acme.com,*.acme.comand so on. A certificate covers exactly the names listed in it, and nothing else. - Who issued it - the certificate authority, such as Let's Encrypt, DigiCert or Sectigo.
- When it's valid - a start date and an expiry date.
- The chain - the intermediate certificates that link it back to a root certificate your browser already trusts.
How a browser checks it
Every time someone opens your site, their browser checks three things:
- The name matches. The address in the browser has to be one of the names in the certificate.
- It's in date. Not expired, and not valid only from some time in the future.
- The chain leads to a trusted root. The server has to send the intermediate certificates too. Many browsers paper over a missing intermediate; phones, older systems and other programs calling your API often don't.
Fail any of the three and the visitor sees a warning instead of your page.
Which names a certificate covers
This is where most surprises come from.
acme.comandwww.acme.comare two different names. A certificate for one doesn't cover the other unless both are listed. Many authorities add both when you ask for one, but not all, and an automated setup asks for exactly what it's told.- A wildcard covers one level.
*.acme.comcoversmail.acme.comandshop.acme.com, but notacme.comitself, and noteu.shop.acme.com. - Wildcards carry a risk. Anyone who gets hold of a wildcard's private key can pose as any subdomain at all, including ones you've never made. A certificate that lists its names one by one limits the damage to those names.
Why certificates keep getting shorter
Browsers and certificate authorities agree the rules for public certificates through the CA/Browser Forum, and in 2025 they voted to cut how long a certificate may last, in steps:
| Issued from | Longest a certificate can last |
|---|---|
| Before 15 March 2026 | 398 days |
| 15 March 2026 | 200 days |
| 15 March 2027 | 100 days |
| 15 March 2029 | 47 days |
A certificate keeps the term it was issued with, so the change arrives one renewal at a time. The direction is clear, though: by 2029 every public certificate will need replacing about every month and a half. Renewing by hand stops being a chore and starts being impossible, which is the point - the aim is that every certificate is renewed automatically.
Automatic renewal still fails - quietly
Automation is the right answer, but it fails in ways nobody sees until a certificate runs out:
- Renewed, but not in use. A new certificate is saved to disk, and the web server is never reloaded to pick it up.
- Renewed in one place only. The load balancer, the CDN or the mail server keeps its own copy, and nothing renews that one.
- The domain check fails. A firewall change, a moved DNS record or a redirect stops the certificate authority from confirming you own the name, and renewal fails, every night, in a log nobody reads.
- The job itself stopped. A server was rebuilt, and the scheduled renewal never came back with it.
The old safety net is gone, too. Let's Encrypt, which issues a large share of the world's certificates, stopped sending expiry reminder emails on 4 June 2025. If renewal breaks, nobody will email you about it.
What to watch
The only certificate that matters is the one your server actually sends to visitors - not the one on disk, and not the one your renewal tool thinks it installed. Watch that, and check:
- The expiry date, with warnings early enough to act - weeks before, then again closer to the day.
- The names, so a certificate for the wrong host is caught before visitors see it.
- The chain, so a missing intermediate is fixed before it breaks a phone or an integration.
- Every service, not just the website - mail on ports 993 and 465, admin panels on 8443, anything else that speaks TLS.
How Mon watches certificates
Mon's SSL monitoring reads the certificate your server presents, on any port, every day, and reminds you 30, 15, 7 and 1 day before it expires, by email or in Slack. When a certificate has expired, is issued for a different name than the server's, is self-signed or missing an intermediate, or isn't there at all, it alerts every contact you've chosen - by email, in Slack, to your own webhook, or by SMS on paid plans. And it shows the certificate each server is really presenting, so after you renew you can see the new one is in use.
It's free for up to 5 certificates, and every website monitor checks its site's certificate as part of each check too. Start for free, or check a certificate now without signing up.
Partho Sarathi
Founder, Maxotek