The certificate nobody's job it is to renew

Your website has a padlock in the address bar, and it has had one for years. Behind that padlock is a TLS certificate — the small file that proves your site is really yours and lets browsers connect securely. It expires on a date you probably couldn’t name, and when the day comes, someone renews it. Usually the same someone. Usually from a reminder email that lands in one particular inbox.

That arrangement works right up until it doesn’t. The person leaves, or is on holiday, or the reminder goes to an address nobody reads any more. The certificate quietly expires. There is no gentle warning to your visitors — the next person who opens your site is met with a full-page red warning telling them the connection isn’t private and they probably shouldn’t continue. Your site isn’t hacked and isn’t down in the usual sense, but to every customer it looks broken and untrustworthy, which for a sales page or a login screen amounts to the same thing.

This is the quiet failure: not that renewal is hard, but that it depends on a human remembering, and the interval between reminders is shrinking.

Why it stays invisible

For years a certificate lasted about thirteen months, so renewing it was an annual chore — irritating, but rare enough to muddle through by hand. That era is ending.

The CA/Browser Forum, the body that sets the rules browsers follow, voted in April 2025 to shorten certificate lifetimes in stages. The first cut has already happened: the maximum fell from 398 days to 200 in March 2026. It drops again to 100 days in March 2027, and to 47 days in March 2029. Each cut makes the manual approach more fragile: a task you used to do once a year becomes something you must do every few weeks, and every renewal is another chance for the reminder to be missed.

The failure stays invisible because nothing warns you in advance except an email, and email is exactly the channel that rots. A distribution list loses its members. A personal address leaves with its owner. The certificate itself gives no outward sign of age — it works perfectly at 364 days and fails completely at 366 — so unless someone is actively watching the expiry date, the first sign of trouble is a customer telling you your site looks broken.

Find it yourself

You can check your own expiry date in under a minute, and you don’t need any tools.

1. Open your site in a browser and click the icon at the left of the address bar. In current Chrome that’s a small tune icon (two sliders) rather than the old padlock; Edge and Firefox still show a padlock.
2. Choose Connection is secure, then Certificate is valid (Chrome/Edge). In Safari the padlock menu has gone: open the Safari menu itself and choose Connection Security Details, then Show Certificate. Labels drift between browser versions, so expect small differences.
3. Look for Valid to or Expires on. That date is your deadline.

If you run more than a handful of sites, checking each padlock by hand doesn’t scale. A free command does the same job for one domain:

echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -enddate

It prints a single line — notAfter=… — which is the expiry date. Run it for each domain you care about and you have your list.

The question to ask once you have the date isn’t “when does it expire” but “who or what renews it, and what happens if that person is away that week”. If the honest answer is “a reminder email to one person”, you’ve found the failure.

The fix

The durable fix is to take the human out of the loop, so renewal happens whether or not anyone remembers.

Most modern hosting already offers this. If your site sits behind a managed platform, a cloud load balancer, or a content delivery network, look for a managed or automatic TLS setting and turn it on — the provider then reissues the certificate for you, silently, well before expiry. If you manage your own server, the standard tool is certbot with Let’s Encrypt: it obtains a certificate and installs a scheduled job that renews it automatically, typically attempting renewal a month before the deadline so there’s plenty of margin.

Automation protects you against the missed reminder, but it can fail quietly too — a renewal job that silently stopped is just a slower version of the same problem. So keep one lightweight backstop: a monitor that checks your live certificate’s expiry date and alerts you if it drops below, say, two weeks. That way, if the automation ever breaks, you hear about it from a calm alert with days to spare rather than from an angry customer.

None of this is difficult, and once it’s set up it largely looks after itself — which, with lifetimes heading towards 47 days, is exactly the point.

Watching an expiry date on a schedule is precisely the sort of quiet task that falls off a busy week. DomainOps keeps an eye on certificate and domain expiry across all your sites and warns you early if a renewal hasn’t landed — but turning on automatic renewal above costs nothing, so do that first, today, whether or not you ever automate the watching too.