Why expiry matters
When a certificate expires, browsers may warn visitors or block the connection. The expiry date gives your agency a concrete maintenance task to discuss with the hosting provider.
Automatic renewal can fail. Confirm both that renewal is configured and that the replacement certificate is being served to visitors.
What Glarion checks
A TLS connection reads the certificate presented by the checked server. This can help reveal a renewal that succeeded on the origin but has not reached the proxy or edge serving visitors.
The free public check flags certificates with fewer than 30 days remaining. Full scans increase priority at 14 and 7 days.
- 30 days
- Plan a renewal review.
- 14 days
- Investigate why renewal has not completed.
- 7 days
- Prioritise the hosting or certificate issue.
Keep renewal and monitoring working together
Each weekly or monthly scan reads the expiry again. Email notifications are sent when scan results change. Scheduled scans require current domain verification.
The schedule determines when a change is observed; it cannot guarantee advance warning. Keep automatic renewal and your hosting provider’s expiry alerts enabled.
Common questions
How long can an SSL certificate be valid now?
Publicly trusted TLS certificates issued since 15 March 2026 can be valid for at most 200 days under CA/Browser Forum ballot SC-081v3. The limit falls to 100 days on 15 March 2027 and 47 days on 15 March 2029. Let’s Encrypt already issues 90-day certificates by default. Shorter lifetimes make working automatic renewal more important, not less.
When does Glarion flag a certificate?
The free check flags a certificate with fewer than 30 days remaining. Full scans on verified domains raise the priority at 14 days and again at 7 days.
Why read the certificate over a live connection?
Because renewal can succeed on the origin server while the proxy or CDN that visitors reach still presents the old certificate. A TLS connection reads what is actually served.
Does scheduled monitoring guarantee advance warning?
No. Each weekly or monthly scan reads the expiry again and an email is sent when results change, so the schedule decides when a change is observed. Keep automatic renewal and your hosting provider’s expiry alerts enabled as well.
Read next
- Check one certificate nowThe free SSL checker: expiry date and days left, no account.
- What the free check includesHeaders, email policies, cookie flags and public files.
- Set up a verified siteAccount confirmation, domain verification and your first scan.
- See the client reportA fictional expiry finding, with evidence and a next step.