Expired TLS certificates are one of the most common causes of unexpected outages. When a certificate expires, clients refuse to establish secure connections, which can immediately break websites, APIs, and internal services.
This article explains how certificate expiration monitoring works and how DevOps teams can prevent outages by tracking certificate validity before expiration occurs.
This lesson is part of the PKI for DevOps Engineers training series. In the previous lesson we explained Java keystores. In this lesson we focus on monitoring certificate expiration and avoiding downtime.
—Table of Contents
- Why certificates expire
- What happens when certificates expire
- Check certificate expiration with OpenSSL
- Monitoring strategies
- Automating certificate checks
- FAQ
Why certificates expire
Certificates include a validity period defined by the Not Before and Not After fields. This expiration window exists for security reasons.
Shorter certificate lifetimes reduce risk if:
- a private key becomes compromised
- a certificate authority must revoke certificates
- cryptographic algorithms become weaker over time
Modern TLS certificates typically have lifetimes between 90 days and 1 year depending on the certificate authority.
If you want to understand where expiration dates appear inside certificates, see our lesson explaining X.509 certificates.
—What happens when certificates expire
When a TLS certificate expires, clients will reject the connection. Browsers, APIs, and applications typically display errors such as:
certificate expiredSSL handshake failedcertificate verify failed
These failures occur during the TLS handshake when the client validates the certificate.
If you want to inspect TLS handshakes directly, see our guide on debugging TLS connections with openssl s_client.
—Check certificate expiration with OpenSSL
You can check the expiration date of a certificate using OpenSSL.
openssl x509 -enddate -noout -in certificate.crtThe output will display the expiration date:
notAfter=Jun 12 12:00:00 2026 GMTYou can also retrieve certificate information directly from a remote server.
openssl s_client -connect example.com:443 | openssl x509 -noout -enddateIf you need to verify certificate chains while performing these checks, see our article on openssl verify.
—Monitoring strategies
Organizations typically use several strategies to prevent certificate expiration outages.
Monitoring systems
Monitoring platforms can periodically check certificate validity and trigger alerts when expiration approaches.
Centralized certificate inventory
Maintaining a central inventory of certificates allows teams to track expiration dates across infrastructure.
Automated renewal
Automating certificate renewal processes eliminates the risk of manual oversight.
Many organizations use automated certificate issuance systems to renew certificates before expiration.
—Automating certificate checks
Many DevOps teams implement simple automation scripts that check certificate expiration daily.
For example:
openssl x509 -checkend 86400 -noout -in certificate.crtThis command checks whether the certificate will expire within the next 24 hours.
If the certificate is close to expiration, the command returns a failure code that monitoring systems can detect.
This technique is commonly used inside automated infrastructure monitoring systems.
—Why certificate monitoring matters
Certificate expiration has caused outages at major organizations, including well-known service providers and large websites.
Monitoring certificates ensures that renewals occur before expiration and prevents unexpected downtime.
Understanding certificate lifecycles also connects with earlier lessons in this series, including certificate chains and certificate signing requests.
—Frequently Asked Questions
Why do TLS certificates expire?
Certificates expire to limit security risks and ensure cryptographic standards remain up to date.
How can I check certificate expiration?
You can check expiration using OpenSSL:
openssl x509 -enddate -noout -in certificate.crtHow far in advance should certificates be renewed?
Many organizations renew certificates 30–60 days before expiration to avoid outages.
Can certificate monitoring be automated?
Yes. Monitoring systems and automation scripts can detect expiring certificates and trigger alerts.
—Next Lesson
In the next lesson you will learn how DevOps teams automate certificate renewal across infrastructure.
Lesson 9 – Automating Certificate Renewal →
—