Many certificates renew automatically, and for months nobody has to think about them. Then renewal fails quietly, and the first sign is an expired certificate.
Renewal proves control of the domain again, usually through a file on the website or a record in DNS. If DNS changed, a firewall blocks the check, or the site moved, the proof fails.
The renewal may succeed, yet the server keeps serving the old certificate until it is reloaded. The file on disk is new, but visitors still see the old one.
Expired payment details, a closed account or a changed email address can stop renewals with a paid provider, and the warnings may go to nobody.
A check from the outside, which reads the certificate the server actually serves, shows the real end date. A shrinking date means renewal is not working.
SSL Domain Detective colours each certificate by how soon it ends, so a stalled renewal shows up as the date gets closer. Open SSL Domain Detective
SSL Domain Detective is now available on the App Store.
Last reviewed: 2026-11-02
#SSL #TLS #Certificates #DomainExpiry #SysAdmin #MSP #iOS
This page gives general information and is not legal, financial or medical advice. [email protected]