Checklist
SSL Certificate Expiry Checklist
SSL expiry problems are preventable, but they still take sites offline, break checkout trust, and make agencies look unprepared. Most expiry incidents trace back to one of three causes: a certificate nobody was tracking, an auto-renewal that failed silently, or a hostname that got left off the list.
Build the hostname inventory
Before tracking expiry dates, make sure the list of hostnames is actually complete. Missing one is the most common way an SSL incident happens.
- Root domain and the www variant, since they're often issued as separate certificates
- Application, staging, and API subdomains (app., staging., api.)
- Checkout and payment-page hostnames, especially on a separate subdomain or CDN
- Client campaign microsites and landing pages that live outside the main domain
- Any wildcard certificate's actual coverage, confirmed rather than assumed
Review before the panic window
Check certificate windows well before renewal deadlines so renewals happen before browsers show certificate errors. A 30/14/7-day review cadence catches most renewal failures with enough runway to fix them calmly instead of during an active incident.
Pair SSL with domain checks
A valid certificate does not help if the domain expires. Monitor both signals in the same workflow, since either one alone can take a site offline the same way.
Common mistakes to avoid
- Trusting a renewal reminder email without confirming the renewal actually completed
- Tracking only the root domain and missing subdomains on separate certificates
- Reviewing expiry once at setup and never again until something breaks
- Not documenting who owns the registrar or hosting account needed to renew
Frequently asked questions
How far in advance should I check for SSL expiry?
A common pattern is to review certificates 30 days before expiry, then again at 14 and 7 days if the renewal hasn't been confirmed yet. Certificate lifetimes have gotten shorter industry-wide, which makes a recurring check more useful than a one-time calendar reminder.
Does auto-renewal mean I don't need to check?
No. Auto-renewal fails silently more often than expected — a billing issue, a DNS validation failure, or a host migration can all break it without any warning email arriving. A live check confirms the certificate actually renewed, not just that it was supposed to.
What's the most commonly missed hostname?
Subdomains issued on separate certificates from the root domain — staging environments, app or api subdomains, and campaign microsites are the ones most often left off a renewal tracking list because they're easy to forget exist.