Skip to content
All articles

Web security · · 5 min read

Expired certificates – the most unnecessary outage

Why certificates still expire, what it costs and how to make sure it never happens again.

Värn

Editorial team

A person working on a laptop in a glass-walled meeting room

Few outages are as visible, as costly and as completely preventable as an expired TLS certificate. The browser shows a full-page warning, customers turn away, integrations stop working – and the problem was known months in advance.

Why does it still happen?

  • Manual renewal. The certificate was bought a year ago by someone who no longer works there, and the reminder went to a mailbox that has been shut down.
  • Automation that quietly stopped working. A renewal job runs, but fails after a change to DNS, the firewall or the load balancer – without anyone noticing.
  • Forgotten servers. The certificate was renewed on the main server but not on the second server behind the same name, or on an older subdomain.

Lifetimes are getting shorter

The industry body CA/Browser Forum has decided that the maximum validity of public TLS certificates will be reduced in steps: to 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029.

With a certificate that is valid for 47 days, manual renewal is in practice no longer an option. Automation – and monitoring that the automation actually works – becomes necessary.

How to avoid it

  1. Automate renewal. Use ACME (for example Let's Encrypt with certbot) or your cloud provider's certificate service.
  2. Monitor from the outside. Check the certificate visitors actually see – not just the one on the server. That catches both failed renewals and missed servers.
  3. Alert in good time. A warning three weeks ahead gives you time to act; a warning the day before gives you stress.
  4. Take stock of every name. Customer portals, web shops, APIs and old campaign pages often have their own certificates.

How Värn helps

Värn checks the certificate of every verified website on every scan: that it is valid, that the chain is trusted, that it matches the host name and how many days remain. A finding is created when 21 days or fewer remain, and the severity is raised to High at 7 days or fewer. Once the certificate has been renewed, the finding closes automatically at the next scan.

Also check that the server does not accept the outdated protocols TLS 1.0 and 1.1. They have been formally deprecated since 2021 (RFC 8996) – Värn checks that too.

More articles