TLS certificate expiration
Respond to the Safe External 30-day warning window and confirm that renewal automation delivered the right certificate everywhere.
Reviewed
Check identity
tls.certificate- Finding
- tls.certificate.expiring-soon
- Severity
- high
What the check observes
After trust and hostname validation succeeds, the scanner compares the presented certificate’s expiration time with the scan time.
The code-owned threshold is fewer than 30 whole days remaining. Evidence records only a bounded day count and expected state.
The check observes the certificate presented by the authorized endpoint during that run, not a certificate inventory from provider APIs.
Why the result matters
An expired certificate can make browsers and clients reject HTTPS connections, causing an avoidable availability and trust incident.
A warning can also reveal renewal automation that succeeded at the certificate authority but failed to deploy at one edge or listener.
How to investigate
- 1
Identify the system responsible for issuance, renewal, deployment, and reload of the certificate.
- 2
Confirm whether a renewed certificate already exists but is not active on the observed endpoint.
- 3
Review all public termination points for inconsistent rollout and confirm the authorized hostname remains covered.
Remediation steps
- 1
Renew or replace the certificate before expiration with enough time to validate deployment.
- 2
Deploy the complete chain to every intended edge, proxy, gateway, or load balancer and reload services safely where required.
- 3
Repair monitoring or automation that allowed the remaining lifetime to enter the warning window unexpectedly.
Verify the change
Confirm the public endpoint presents the renewed certificate and that its validity, hostname coverage, and chain are correct.
Run a new authorized scan and confirm at least 30 days remain under the current Safe External v1 rule.
Limits of this check
- The 30-day threshold is a product rule, not a guarantee that every organization has enough time for its renewal process.
- A passing result does not prove future automated renewal will succeed or that every separate hostname and endpoint presents the same certificate.