Skip to main content
mediumSecurity & Infrastructure

TLS Certificate Expiry Runway

An expired TLS certificate replaces your product with a full-page browser security warning. SaaSalyst inspects your live certificate's expiry and flags a short runway before it becomes an outage.

What SaaSalyst Checks

SaaSalyst opens a TLS connection to your domain and reads the served certificate's notAfter date. A comfortable runway passes, under 30 days warns, and under 7 days fails — the one hard-fail state in the continuity suite, because a week of runway on an unmonitored cert is an outage countdown.

Why This Matters

Certificate expiry is loud, total, and instantly visible to every visitor: browsers interstitial the whole site. Managed platforms (Vercel, Netlify, Cloudflare) auto-renew, which is why a short runway usually means a custom or legacy setup where renewal automation broke — precisely the case worth catching early.

How to Fix It

  1. If hosted on a managed platform, short runway usually means a custom certificate or a stalled renewal — check the platform's domain panel.
  2. If self-managing, automate with ACME/Let's Encrypt (certbot or your proxy's built-in ACME) rather than calendar reminders.
  3. After renewal, verify the SERVED chain updated: echo | openssl s_client -connect yourdomain.com:443 | openssl x509 -noout -enddate.

Frequently Asked Questions

My platform auto-renews certificates — can this still fire?

Rarely, and that is the point: on managed platforms this check is free assurance. SaaSalyst reads the certificate actually served in production, so it catches the cases automation silently missed — stalled DNS validation, a stale custom cert overriding the managed one.

Why does this check have a fail state when the other continuity checks only warn?

Because the evidence is direct. SaaSalyst reads the expiry from the live certificate itself, so a sub-7-day runway is a verified, imminent outage — unlike email records, where the scanner cannot know your sending posture and warns instead.

Check Your SaaS Now | Free

SaaSalyst scans your website in 30 seconds and checks for TLS Certificate Expiry Runway along with 118+ other business readiness signals.

Scan Your App

Related Checks SaaSalyst Runs