SSL Certificate Expiring
Severity: Medium (reported separately at Critical once the certificate has actually expired)
Last updated August 9, 2026.
What it means
The SSL/TLS certificate presented by this domain has an expiration date that is either already past, or close enough that it will lapse without action. Once a certificate expires, browsers stop trusting the connection outright and show a full-page warning to visitors.
Why it matters
An expired certificate is treated by browsers as a hard failure, not a soft warning — most visitors will not click through it. For API endpoints, webhooks, and other machine-to-machine connections, an expired certificate can silently break integrations with no visible warning to anyone until something downstream fails.
What Nivaronix checks
Nivaronix reads the certificate's notAfter date during a TLS handshake and flags it once it falls inside a configured warning window, and again (at higher severity) once it has actually lapsed. This is a certificate-expiry check, not a scan for vulnerabilities in the server software itself.
Example evidence
Illustrative example, not a live scan result. Run the checker below to see your own domain's actual status.
Illustrative example only — not a live scan result.
Certificate: CN=example.com
Issuer: Let's Encrypt Authority
Valid from: 90 days ago
Valid until: tomorrow (expires in 1 day)
Status: EXPIRING SOONHow to fix it
- Identify the certificate's issuer and renewal mechanism (manual purchase, ACME auto-renewal, load balancer/CDN managed cert).
- If using Let's Encrypt or another ACME-based CA, confirm the auto-renewal job (certbot, acme.sh, or your platform's managed TLS) actually ran and didn't silently fail.
- If the certificate is purchased annually from a commercial CA, renew it before the expiry date and reinstall it on every server or load balancer that terminates TLS for the domain.
- Set a calendar reminder or automated alert at least 30 days before expiry so renewal isn't a last-minute scramble.
How to verify the fix
Re-run the SSL/TLS checker against the domain, or open the site in a browser and inspect the certificate's validity dates directly. The new expiry date should be well in the future and the warning should clear.
FAQ
What happens the moment a certificate expires?
Browsers stop trusting the connection outright and show visitors a full-page warning — it's a hard failure, not a soft one most people click through. For machine-to-machine connections like API endpoints and webhooks, there's often no visible warning to anyone at all until something downstream breaks.
Why does this finding fire before the certificate has actually expired?
Nivaronix reads the certificate's notAfter date and flags it once it falls inside a configured warning window, then again at higher severity once it has actually lapsed. The point of flagging early is to give time to renew before the hard failure happens — an already-expired certificate is a much more urgent, higher-severity version of the same finding.
Can certificate renewal be automated so this doesn't happen again?
Yes — Let's Encrypt certificates (90-day validity) are designed around automated renewal via ACME clients like Certbot, and most hosting platforms and CDNs handle renewal for certificates they provision automatically. A manually issued longer-lived certificate is the more common source of a surprise expiry, since it's easier to forget.
Does an expiring certificate affect SEO?
Not the ranking algorithm directly, but an expired certificate stops the page from loading normally in a browser at all — visitors bounce off the warning screen, and a crawler encountering the same broken HTTPS connection can fail to index the page. The practical effect on traffic is closer to a full outage than a ranking penalty.
Check your certificate now
Free, no signup required.