The TLS certificate is expired or about to expire

Audit check cert · worth 8 of 100 points · all checks

What the audit saw

The certificate is invalid, does not match the hostname, or expires within 14 days.

Why it costs you

An expired certificate turns the whole site into a full-page browser warning that most visitors will not click through. Renewal is free and automatic on every modern host, so a failure here is always a configuration gap rather than a cost problem.

How to find it on your site

  1. Read the real expiry date and the names it covers 
    echo | openssl s_client -servername your-site.com -connect your-site.com:443 2>/dev/null | openssl x509 -noout -dates -subject -issuer
  2. Let's Encrypt with automatic renewal 
    certbot --nginx -d your-site.com -d www.your-site.com --redirect
systemctl list-timers | grep certbot
  3. Check the renewal timer is actually armed 
    systemctl status certbot.timer --no-pager | head -5

How to know it is fixed

notAfter should be more than 30 days out. If the timer is dead the certificate will lapse again silently, which is how most of these expire in the first place.

The part people get wrong

A certificate that is valid but issued for the wrong name (www vs apex) produces the same browser warning. Cover both names in one certificate.

Check it against your own site

Open an issue with your URL and a bot runs this check plus 14 others, posts the failures with the measured values, and publishes a report page: free audit. If you want the fixes applied and re-verified instead: fixed-price tiers.

Other checks

The site does not answer on the URL you gave · The page is served over plain HTTP · No mobile viewport tag · The page title is missing or the wrong length · The meta description is missing or the wrong l · The page has no H1, or more than one · Images have no alt text · Responses are not compressed

All published audits · Check reference