What actually expires
The certificate served by your domain has a validity period. Once it passes that date, browsers stop trusting it.
That means warnings, blocked sessions, checkout disruption, and a sudden loss of confidence.
Why renewals still fail
Auto-renewal is helpful but not infallible. DNS changes, proxy changes, challenge failures, wrong server blocks, and stale automation can break the renewal flow silently.
What to watch for
A healthy setup should tell you how many days remain, whether the certificate is valid for the hostname, and whether the server is actually presenting the expected chain.
- Days remaining until expiry
- Correct hostname coverage
- Valid chain of trust
- No self-signed or invalid fallback cert
The practical takeaway
Do not rely on memory. Put certificate expiry in a system that checks it for you and warns you before it becomes urgent.
- Certificate serves the right hostname
- Certificate is not close to expiry
- Renewal automation is documented
- Port 443 is correctly configured
- Fallback certificates are not being served