dotvitals

TLS certificate expires in under 7 days

HighConfirmedQuick wintls.certificate.expiring-lt-7d

What this check looks for

The certificate is about to run out. If renewal has not already succeeded, your site goes down within the week.

Why it matters

Renewal being this close usually means automatic renewal has already failed at least once — most tools try at 30 days. Left alone this becomes an outage, and outages of this kind always land at a weekend.

When the check passes, your report says: “The certificate has more than a week left to run”.

What it costs your score

When this check fails it removes 25 points from your TLS score, before the status, confidence and repeat multipliers are applied. TLS carries a weight of 15 in the overall score.

It shares the tls.certificate family ceiling of 60 points: however many findings that family produces, together they cannot remove more than that from TLS. One underlying problem showing up in several places is still one problem.

Severity
high
Default confidence
confirmed
Status when triggered
fail
Deduction
25 points
Family cap
tls.certificate · 60
Category
TLS
Module
Tls certificate
Fix owned by
user
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Renew now, and find out why automatic renewal has not already done it.

Inside seven days there is no margin left for a failing renewal to be retried.

  1. Run the renewal by hand and confirm it succeeds.

  2. Check the renewal timer is enabled and has actually fired: systemctl list-timers | grep certbot.

  3. Confirm the ACME challenge path is reachable — a redirect of /.well-known/acme-challenge/ to HTTPS or to another host is the most common cause.

How to confirm it worked

  • openssl s_client -connect ‹host›:443 -servername ‹host› </dev/null 2>/dev/null | openssl x509 -noout -enddate

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Remediation by platform

nginx
certbot renew --cert-name ‹host›
nginx -t && systemctl reload nginx
Apache
certbot renew --cert-name ‹host›
apachectl configtest && systemctl reload apache2
Caddy
journalctl -u caddy -n 200 | grep -i renew

  • Caddy renews automatically; this is about finding out why it has not.

Technical detail

notAfter=‹not after› for ‹host›, which is ‹days remaining› days away. ACME clients begin attempting renewal at one third of the remaining lifetime — 30 days for a 90-day certificate — so a certificate still unrenewed inside 7 days indicates a failing renewal path, not a tight schedule.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the tls certificate checkerBuild the fix

Other tls certificate checks