Why certificate outages still happen in 2026

An expired certificate is the most preventable outage in computing, and it still takes down big-name sites every month. The pattern is rarely "nobody set up renewal." It is:

  • Renewal was automated, then the automation broke — a DNS change invalidated the ACME challenge, a credential expired, a cron host was decommissioned — and nothing was watching the watcher.
  • The certificate renewed, but the deployed copy did not: a load balancer, CDN edge or legacy box kept serving the old one.
  • The main site was fine and a forgotten hostname — api, mail, the status page, an old regional domain — expired instead.

All three failures share a property: they are invisible from the inside and obvious from the outside. That drives the core principle: monitor what the internet sees, not what your renewal system says it did.

The deadline treadmill is accelerating

The CA/Browser Forum — with Apple, Google and Mozilla pushing — has scheduled maximum certificate lifetimes down from today's 398 days: 200 days from March 15, 2026, 100 days from March 2027, and 47 days from March 2029. The stated goal is to make automation mandatory in practice. A team tracking renewals in a spreadsheet copes at one renewal a year per cert; at eight per year across a dozen hostnames, manual tracking is arithmetic that always eventually loses.

Step 1: automate issuance

If anything you run still involves a human downloading a certificate file annually, fix that first: ACME with Let's Encrypt (certbot, Caddy, Traefik and every major web server support it) or your platform's managed certificates (CloudFront/ACM, Cloudflare, Vercel, Netlify and peers renew automatically). Managed certs move the renewal problem to the provider, which is where you want it.

Step 2: monitor externally anyway

A useful expiry monitor has four properties:

  1. It checks the live handshake from the internet, per hostname — catching the broken-automation and stale-deployment cases automation reports miss.
  2. It covers every hostname, including ones you forgot. Certificate transparency logs are the discovery mechanism: every publicly issued cert for your domains is in them, which is how monitors find the api/staging/legacy hosts your list missed.
  3. It escalates as the deadline nears — a 30-day heads-up, then 14, 7 and 3. One email 30 days out gets archived and forgotten; day-3 should page someone.
  4. It also flags unexpected issuance. A certificate for your domain from a CA you do not use is either shadow IT or an attack — either way, worth an alert. (Pair this with a CAA record restricting which CAs may issue for you.)

Free and DIY options

  • One-off checks: Qualys SSL Labs gives the deep analysis; even openssl s_client -connect host:443 | openssl x509 -noout -enddate answers the expiry question for one host.
  • DIY scripts: a cron job looping hostnames through openssl and mailing on <30 days works — until the cron host, the mail delivery or the hostname list rots. You have recreated the watch-the-watcher problem one level up, which is fine as long as you know it.
  • Uptime monitors: several (UptimeRobot and similar) include basic expiry alerts on paid tiers for hosts you explicitly list.
  • Continuous external monitors: tools like Bastion check the live handshake for every discovered hostname on your verified domains, warn at 30/14/7/3 days, and alert on certificates issued by unexpected CAs — alongside the other external checks in the same scan.

A checklist that survives 47-day certs

  • Issuance automated everywhere (ACME or platform-managed) — no annual human step.
  • External monitoring of the live handshake on every hostname, with escalating alerts.
  • Hostname inventory fed by certificate transparency, not memory.
  • CAA record limiting issuance to the CAs you actually use.
  • Renewal failure alerts from the automation itself (certbot/ACME client logs) as the inner loop; external monitoring as the outer loop.

Frequently asked questions

How long do SSL/TLS certificates last now?

The current maximum is 398 days, dropping by CA/Browser Forum ballot to 200 days on March 15, 2026, 100 days in March 2027, and 47 days in March 2029. Many certificates are already much shorter in practice — Let's Encrypt issues for 90 days and renews automatically.

What is the best free way to get certificate expiry alerts?

Automate renewal with Let's Encrypt/ACME so expiry alerts become a failsafe rather than a process, then add an external check: a small script that reads the live certificate's end-date per hostname, or a free/cheap monitor tier that alerts under 30 days. The critical details are checking from outside (what users actually see) and covering every hostname, not just the main site.

Why did my site show an expired certificate when renewal is automated?

The usual causes: the ACME challenge started failing after a DNS or firewall change; the renewed certificate was issued but never deployed to a load balancer, CDN or stray legacy server; or the expired hostname is one your automation never covered. All three are caught by externally checking the certificate each hostname actually serves.