SSL Certificate Expiration

Why every SSL certificate has an expiry date

SSL certificate expiration is the date after which a certificate stops being valid. Every certificate carries a start date and an end date, called the not-after date, which the issuing certificate authority sets when it signs the certificate.

Expiry is a deliberate design choice. A certificate binds a domain name to a public key, and that binding should not last forever. Keys can be stolen, organizations change hands and domain ownership can move. A fixed end date limits how long an outdated or compromised binding can cause harm.

When a certificate expires, the site does not degrade gradually. Visitors see a full warning page, and many automated clients, such as API calls, mobile apps and monitoring tools, fail outright. That is why expiry is one of the most common causes of avoidable outages. Revocation is a separate process for certificates that must be invalidated early, as explained in the revocation article.

Manual renewal compared with automated renewal

Renewal means obtaining a new certificate before the current one expires. With manual renewal, someone generates a new key and a certificate signing request, obtains a certificate and installs the files on each server that uses it. This works for a handful of certificates, but every step depends on a person remembering a date.

Automated renewal removes that dependency. Client software on the server requests a new certificate on a schedule and installs it without human action. The ACME protocol is the most widely used standard for this, and it has its own article.

Even with automation, many teams monitor expiry dates and alert themselves weeks ahead. Automation can fail silently, for example when a validation challenge breaks after a server change, and a monitor is the only early warning.

Why certificate lifetimes keep getting shorter

Certificate lifetimes, also called validity periods, have been shortened over the years. The browser industry sets the maximum allowed length through rules that certificate authorities must follow, and the trend continues toward shorter periods.

Shorter lifetimes reduce the damage from a compromised key, because a stolen key is only useful until its certificate expires or is replaced. They also push website owners toward automation, since renewing a certificate by hand every few months does not scale.

A shorter lifetime makes automation more important, not less. A site that renews by hand once a year can manage with a calendar reminder. A site whose certificate lasts only a few weeks cannot.