SSL certificate expires soon
sec_cert_expiryShort answer
The certificate your site serves on port 443 expires in less than 30 days. Once it expires, browsers block the site behind a security warning until a new one is installed. Renew it now, and find out why automatic renewal has not already done it: a healthy Let's Encrypt setup renews around the 30-day mark, so a warning that lasts more than a day or two means renewal is failing.
Why it matters
An expired certificate puts an interstitial such as NET::ERR_CERT_DATE_INVALID in front of every visitor. Few people click through, and forms, checkout, mobile apps, API clients and webhooks stop connecting altogether. Unlike most security checks, this one affects search too: Google prefers the HTTPS version of a page only when its certificate is valid, and visitors arriving from search results land on the warning page.
Certificate lifetimes keep getting shorter. Under CA/Browser Forum ballot SC-081 the maximum lifetime of public certificates is being reduced in steps from March 2026 until it reaches 47 days in 2029, Let's Encrypt certificates last 90 days, and Let's Encrypt stopped sending expiry reminder e-mails in 2025. Manual renewal and reminder e-mails are no longer a reliable plan; automated renewal plus monitoring is.
How Glimana detects it
Glimana opens a TLS connection to your site's hostname on port 443 and reads the expiry date of the certificate it receives, the same one a visitor gets (behind a CDN that is the CDN's edge certificate, not the one on your origin server). The whole days left decide the result: already expired or under 7 days is critical, 7 to 13 days high, 14 to 29 days medium, and 30 days or more passes. If no TLS connection can be made, the check shows Could not be measured.
How to fix it
Watch out
Behind Cloudflare or another proxy, Glimana only sees the edge certificate. The certificate on your origin server can expire unnoticed, and with Cloudflare's Full (strict) mode that turns into a 526 error for every visitor. Check the origin certificate separately, or install a Cloudflare Origin CA certificate there, which can be issued for up to 15 years.
- Find the finding in Glimana. Open Security; this check is in the Certificate and HTTPS group, with the evidence from the last scan under its title. The same problem is listed under Issues › SSL certificate expires soon.
-
Apply the fix on your platform.
List installed certificates and their expiry dates:
sudo certbot certificates. Test renewal without changing anything:sudo certbot renew --dry-run. If the dry run fails, the error names the cause, usually a DNS record that now points elsewhere, a firewall closing port 80 for the HTTP-01 challenge, or a rule that blocks/.well-known/acme-challenge/. Fix it, then runsudo certbot renew.Make sure renewal is scheduled (
systemctl list-timers | grep certbot) and that the web server reloads afterwards so it serves the new file, for examplesudo certbot renew --deploy-hook "systemctl reload nginx".cPanel: open Security › SSL/TLS Status, select the domains and click Run AutoSSL. The page shows why a domain was skipped, most often a DNS record that points to another server or a CAA record that does not allow your host's certificate authority. Plesk: open SSL/TLS Certificates (SSL It!) for the domain and turn on Keep websites secured so renewal is automatic.
A certificate bought from a commercial CA does not renew by itself: renew it with the CA and install the new certificate in the panel before the old one expires.
On proxied (orange-cloud) records visitors see Cloudflare's edge certificate. Universal SSL renews automatically; SSL/TLS › Edge Certificates shows its status and expiry date. Renewal can stall when domain validation fails, for example after nameserver or CAA changes; the certificate row then shows a pending or validation status. A custom certificate you uploaded yourself never renews automatically: upload the replacement before the old one expires.
- Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.
How the fix is verified
Press Re-scan on the Security page (or wait for the weekly Sunday scan); the problem closes when the check passes.