Skip to content

Basics

My TLS certificate is expiring

When it lapses, every visitor sees a full-page browser warning and search engines stop crawling. That is an outage, not a warning. Let's Encrypt attempts renewal at 30 days remaining, so being inside 14 means automated renewal is broken.

What 13x checks

This is rule basics.certificate-expiry in the public registry: Certificate is not about to expire. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Basics
Score weight
14 of the readiness score
Scope
Runs on every audited page
Applies
Only where the market or the page shape makes it relevant

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

The certificate expires on ( days).

If you are on a managed host — Vercel, Netlify, Cloudflare, Railway, Fly — renewal is automatic, so reaching this point means something is blocking it. Usually DNS: the domain no longer points at the platform, or a CAA record forbids the issuing CA. Check the domain settings in the dashboard for a verification error.

On your own server with Certbot:

bash code
# Is the renewal timer actually running?
systemctl list-timers | grep certbot

# Dry-run the renewal to see the real error
sudo certbot renew --dry-run

# Renew now
sudo certbot renew --force-renewal && sudo systemctl reload nginx

The usual causes are a port 80 redirect that breaks the HTTP-01 challenge, or a webroot path that moved.

Then set up an alert. Let's Encrypt stopped sending expiry emails in 2025, so nothing will warn you next time.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More basics checks