Expiring TLS certificate

The most common cause is a validation challenge that stopped resolving. Automated issuance proves control of the domain by serving a file under `/.well-known/acme-challenge/` or by publishing a DNS record; a redirect rule added months earlier that catches that path breaks the proof.

A second is a renewal job that is no longer running: a cron entry lost in a server migration, a container rebuilt without its scheduler, a systemd timer disabled during unrelated maintenance.

A third is a renewal that succeeds and is never loaded. The new certificate is written to disk and the web server keeps serving the old one from memory because nothing reloaded it.

A fourth is a certificate issued for fewer hostnames than the server now answers on, so the renewal works and one subdomain starts failing.

A fifth is rate limiting from the issuing authority after repeated failed attempts, which turns a recoverable problem into a blocked one at exactly the wrong moment.

And a sixth is manual renewal that depended on one person, who has moved on.

It refuses the connection and shows a full-page interstitial naming the problem — `NET::ERR_CERT_DATE_INVALID` in Chrome.

Clicking through is possible on some errors and deliberately awkward, and on a site with HSTS it is not possible at all: the browser has been told to require a valid certificate and offers no bypass.

That interaction between HSTS and expiry is worth understanding. HSTS is correct and it removes the escape hatch, so a site with HSTS and an expired certificate is completely unreachable until the certificate is fixed.

Non-browser clients — mobile apps, API consumers, webhooks from payment providers — fail without any interstitial at all, usually with a generic connection error that takes longer to diagnose.

`openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -dates` prints the validity window.

Check every hostname you serve, not the apex alone: `www`, any API subdomain, any regional host. Certificates cover a specific list and the list drifts.

Check from outside your own network. A server may present a different certificate internally, and an internal check is the one most likely to be reassuringly wrong.

Verify the chain as well as the dates. A certificate that is valid but served without its intermediates fails for some clients and works for others, which is a separate and confusingly intermittent problem.

Monitor continuously rather than checking occasionally. This is a scheduled failure, and the only useful check is one that runs without anyone remembering it.

Automate issuance and renewal, then monitor the expiry date externally. The automation is not the safeguard; the external check on the date is, because it observes the outcome rather than the process.

Alert early — thirty days is a reasonable floor, because it leaves room for a rate limit or a DNS change to be resolved before the date.

Exclude the ACME challenge path from every redirect and rewrite rule, and test that exclusion after any change to the redirect configuration.

Make the renewal reload the service, and confirm it by checking the served certificate rather than the file on disk.

Keep the hostname list in one place, so adding a subdomain adds it to the certificate rather than creating a future failure.

Prefer DNS-based validation where a redirect layer makes the HTTP challenge fragile, and keep the credentials for it somewhere the renewal can reach.

`transport.certificate_details` connects over HTTPS, reads the certificate the server presents, and reports its issuer, its validity dates and the time remaining.

`transport.certificate_coverage` reports which hostnames the certificate actually covers, which is the adjacent failure where renewal works and one host is left out.

`transport.https` and `transport.tls_failure` report the connection outcome itself, so a certificate that has already expired appears as a failure rather than as a date in the past.

The observation is external, which is the point: it sees what a visitor's browser sees rather than what the renewal log says happened.