dotvitals

TLS certificate expires in under 30 days

MediumConfirmedQuick wintls.certificate.expiring-lt-30d

What this check looks for

The certificate still works, but it runs out within the month. This is the point where automatic renewal should already have replaced it.

Why it matters

Thirty days is the window every automatic renewal tool aims at. A certificate still sitting here is a signal that renewal is not running, and that is much easier to fix now than during the outage.

When the check passes, your report says: “The certificate has more than a month left to run”.

What it costs your score

When this check fails it removes 10 points from your TLS score, before the status, confidence and repeat multipliers are applied. TLS carries a weight of 15 in the overall score.

It shares the tls.certificate family ceiling of 60 points: however many findings that family produces, together they cannot remove more than that from TLS. One underlying problem showing up in several places is still one problem.

Severity
medium
Default confidence
confirmed
Status when triggered
warn
Deduction
10 points
Family cap
tls.certificate · 60
Category
TLS
Module
Tls certificate
Fix owned by
user
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Confirm automatic renewal is working, rather than waiting to see.

A renewal that is going to fail fails silently; you find out when the site stops loading.

  1. Run a dry-run renewal and read the output rather than the exit code.

  2. Confirm the renewal job is scheduled and has run recently.

  3. Make sure /.well-known/acme-challenge/ is served over plain HTTP without a redirect to another host.

How to confirm it worked

  • certbot renew --dry-run — expect a success line for ‹host›

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

nginx
certbot renew --dry-run
systemctl list-timers | grep certbot
Caddy
# Caddy manages renewal itself; make sure storage is persistent across restarts.
{
	storage file_system /var/lib/caddy
}
Technical detail

notAfter=‹not after› for ‹host›, ‹days remaining› days away. A 90-day ACME certificate is normally replaced at the 30-day mark; a certificate observed inside that window either renews in the next few days or does not renew at all.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the tls certificate checkerBuild the fix

Other tls certificate checks