TLS certificate expires in under 30 days
What this check looks for
The certificate still works, but it runs out within the month. This is the point where automatic renewal should already have replaced it.
Why it matters
Thirty days is the window every automatic renewal tool aims at. A certificate still sitting here is a signal that renewal is not running, and that is much easier to fix now than during the outage.
When the check passes, your report says: “The certificate has more than a month left to run”.
What it costs your score
When this check fails it removes 10 points from your TLS score, before the status, confidence and repeat multipliers are applied. TLS carries a weight of 15 in the overall score.
It shares the tls.certificate family ceiling of 60 points: however many findings that family produces, together they cannot remove more than that from TLS. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- warn
- Deduction
- 10 points
- Family cap
- tls.certificate · 60
- Category
- TLS
- Module
- Tls certificate
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Confirm automatic renewal is working, rather than waiting to see.
A renewal that is going to fail fails silently; you find out when the site stops loading.
Run a dry-run renewal and read the output rather than the exit code.
Confirm the renewal job is scheduled and has run recently.
Make sure
/.well-known/acme-challenge/is served over plain HTTP without a redirect to another host.
How to confirm it worked
certbot renew --dry-run — expect a success line for ‹host›
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Remediation by platform
certbot renew --dry-run
systemctl list-timers | grep certbot# Caddy manages renewal itself; make sure storage is persistent across restarts.
{
storage file_system /var/lib/caddy
}Technical detail
notAfter=‹not after› for ‹host›, ‹days remaining› days away. A 90-day ACME certificate is normally replaced at the 30-day mark; a certificate observed inside that window either renews in the next few days or does not renew at all.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other tls certificate checks
- Certificate chain is missing an intermediate
- Certificate chain is not in the required order
- TLS certificate has expired
- TLS certificate expires in under 7 days
- Certificate does not cover the hostname
- Certificate has no Subject Alternative Name
- TLS certificate is not valid yet
- Certificate is self-signed
- Certificate could not be parsed
- Certificate does not chain to a trusted root
- Certificate is valid for longer than a public CA may issue
- Certificate uses a key that is too small