Skip to main content

Expiration Findings

Every certificate is valid between two dates, its Not Before and Not After. These findings cover a certificate that is about to expire, has expired, or isn't valid yet.

To confirm any fix on this page, install the new certificate and click Check Now on the monitor's page. openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates shows the dates of the certificate the server is sending.

CERT_EXP01: Certificate expires soon​

Key: CERT_EXP01 · Label: Expires Soon · Severity: Warning · Can be dismissed: No

What it means: the certificate expires within the expiration warning set on the monitor's profile. This finding comes from the monitor's state rather than a single check: on the Findings page it shows how long until the certificate expires (for example "in 15 days").

Why it matters: once it expires, browsers and clients refuse the connection.

How to fix it: renew the certificate and install it before it expires. If renewal is automatic (such as ACME with Let's Encrypt), check that the renewal job is running and that the server reloads the new certificate; a renewed certificate that the server never picked up still expires.

CERT_EXP02: Certificate has expired​

Key: CERT_EXP02 · Label: Expired · Severity: Error · Can be dismissed: No

What it means: the certificate is past its Not After date.

Why it matters: browsers and clients reject the connection, or warn users away from it.

How to fix it: renew the certificate and install it on the server now. Remember every server, load balancer and CDN node behind the hostname: one that still serves the old certificate keeps this finding open.

CERT_EXP03: Certificate validity dates are invalid​

Key: CERT_EXP03 · Label: Invalid Expiration Dates · Severity: Error · Can be dismissed: No

What it means: the certificate's validity dates are invalid, or its Not Before date is still in the future.

Why it matters: clients reject a certificate that isn't valid yet just as they reject an expired one.

How to fix it: reissue the certificate if its dates are wrong. If it was issued moments ago, it becomes valid at its Not Before time; check the clock of the system that issued it.