SSL certificate expiry monitoring in the age of short certificates
Last reviewed 9 November 2026
Certificate lifetimes are shrinking every year, and Let’s Encrypt no longer emails expiry reminders. Renewals are automated almost everywhere, which means failures are silent. This guide covers the new limits, how to check expiry yourself, and how to get warned in time.
Certificate lifetimes are shrinking
Under CA/Browser Forum ballot SC-081v3, the maximum validity of a publicly trusted TLS certificate depends on when it is issued:
| Issued on or after | Maximum validity | Domain validation reuse |
|---|---|---|
| Before 15 March 2026 | 398 days | 398 days |
| 15 March 2026 | 200 days | 200 days |
| 15 March 2027 | 100 days | 100 days |
| 15 March 2029 | 47 days | 10 days |
Certificates keep the validity they were issued with, so longer certificates issued before 15 March 2026 stay in use until about April 2027. Many CAs issue a day short of the maximum (for example 199 days).
Let’s Encrypt is moving faster: its default certificates go from 90 to 64 days on 10 February 2027 and to 45 days on 16 February 2028. It also stopped sending expiration reminder emails on 4 June 2025, so nobody will tell you a renewal failed unless you monitor it yourself.
Why automated renewals still fail
- The certificate renewed, but the web server, load balancer or CDN still serves the old one.
- DNS or HTTP validation broke after a DNS move, a firewall change or a new redirect.
- A cron job or ACME client stopped running, or renews on a hard-coded schedule that no longer fits shorter lifetimes.
- A second hostname (www, shop, an old landing page) was never part of the automation.
Shorter lifetimes mean these failures surface more often, with less slack between “renewal failed” and “browsers show a full-page warning”.
What to monitor
- The certificate the site actually serves, not just what your CA or hosting panel says was issued.
- Every hostname visitors use, including www and subdomains.
- Enough warning to act: at least two weeks while lifetimes are 100–200 days.
Check SSL expiry yourself
From a terminal (prints the served certificate’s expiry date):
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
| openssl x509 -noout -enddateOr paste a domain into the free SSL & domain expiry checker, or call its JSON API:
curl "https://steadysite.dev/api/ssl-check?domain=example.com"The response includes ssl.expires_at, ssl.days_left, the issuer, the domain registration expiry and the site’s HTTP status. See the OpenAPI spec.
Get alerted automatically
Add the site to SteadySite as a monitor. It reads the served certificate (with a certificate-transparency log fallback for hosts it can’t reach directly) and emails you 14, 7, 3, 1 days before expiry, alongside uptime checks and domain-expiry warnings. The free plan covers 10 sites, commercial use included. For agencies, each client’s monthly report shows SSL expiry next to uptime.
Frequently asked questions
What is the maximum SSL certificate lifetime in 2026?
Publicly trusted TLS certificates issued on or after 15 March 2026 can be valid for at most 200 days. The limit drops to 100 days on 15 March 2027 and 47 days on 15 March 2029 (CA/Browser Forum ballot SC-081v3).
Does Let’s Encrypt still send expiry emails?
No. Let’s Encrypt turned off its expiration notification emails on 4 June 2025. Use a monitoring service if you want a warning before a certificate expires.
How do I get alerted before an SSL certificate expires?
Monitor the certificate your site serves. SteadySite checks it and emails you 14, 7, 3, 1 days before expiry; the free plan covers 10 sites. For a one-off check, use steadysite.dev/ssl-checker.
How can I check when an SSL certificate expires?
Run: echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate, or use a free checker such as steadysite.dev/ssl-checker.
Uptime, SSL and domain expiry, in one report per client
Start with 10 free monitors. Commercial use allowed, no credit card.