Short answer: An SSL certificate stops being valid on a fixed date, and after it browsers show visitors a certificate error instead of a secure page. Check the date, renew automatically and keep an alert of your own. Let’s Encrypt certificates last 90 days, and Let’s Encrypt advises renewing them every 60.
What happens when a certificate expires
Every certificate carries an expiry date, which OpenSSL calls notAfter. Once that date passes, the certificate is no longer valid, and visitors get a warning instead of your page. Chrome’s help lists certificate errors such as “Your connection is not private”, and NET::ERR_CERT_DATE_INVALID for dates.
Let’s Encrypt, the free certificate authority many hosts use, issues certificates valid for 90 days by default, and says there’s no way to change that. It has also ended its expiration email service, so it no longer warns you before a certificate runs out.
Our SSL certificate guide explains what the certificate does and how to move a site to HTTPS.
Why public certificates keep getting shorter
The CA/Browser Forum, where certificate authorities and browser makers agree on the rules, voted to cut the longest allowed lifetime of a public certificate from 398 days to 47. The cuts come in steps that started in March 2026, and Apple, Google, Microsoft and Mozilla all voted yes.
Let’s Encrypt is cutting its own default from 90 days to 45, also in steps. It warns that renewing at a fixed 60-day interval won’t be enough for 45-day certificates.
| Certificate | How long it lasts | When to renew it |
|---|---|---|
| Let’s Encrypt default | 90 days | Every 60 days |
| Let’s Encrypt short-lived | 6 days | Every 3 days |
| Let’s Encrypt 45-day, opt-in from May 13, 2026 | 45 days | With ACME Renewal Information, or two thirds of the way through |
From Let’s Encrypt’s FAQ and its post on 45-day certificates, read November 4, 2026.
Let’s Encrypt recommends ACME Renewal Information, a feature that tells your renewal software when to renew. Without it, it suggests renewing about two thirds of the way through a certificate’s life.
How to check when your certificate expires
- Open your site in Chrome and check the security symbol to the left of the web address.
- For the exact date, read the certificate with OpenSSL and print its notAfter date with the x509 command’s -enddate option.
- Check every address you use, such as the version with www and any subdomain.
- Ask your host whether your certificate renews automatically, and when the next renewal is due.
- If you renew it yourself, use renewal software that supports ACME Renewal Information.
- Set an alert of your own a few weeks before the date, since Let’s Encrypt no longer emails you.
- After each renewal, check the new dates the same way.
Our web hosting guide covers what your host should handle, and our website maintenance guide covers the other routine checks a site needs.
How we watch our own certificates
Our website’s certificate comes from Let’s Encrypt and lasts 90 days: the current one runs from October 4 to January 2. Our server checks every night which certificates are due and has this one down for renewal on December 3, after 60 days, as Let’s Encrypt advises.
On November 4, 2026 we added a daily check of the five addresses we look after: our website with and without www, and three internal tools. It warns us when a certificate has fewer than 21 days left, fails verification or doesn’t answer, after one retry.
Its first run found our website at 58 days and one internal certificate at 34, outside the automatic renewal. We added that internal certificate to the same renewal that morning, and on the next run it read 90 days.
Before your next renewal
- You know when your certificate expires.
- It renews automatically.
- Your renewal software can handle shorter lifetimes.
- Something warns you weeks before the date.
- Every address you use has its own check.
- You read the new dates after each renewal.
RememberPublic certificates are getting shorter, down to 47 days at the end of the industry’s schedule. Renew them automatically and keep your own alarm on the date.
Certificate and availability checks like these are part of our technical SEO service. Our website down guide covers what Google does when a site stops answering.
Quick answers about SSL certificate expiration
What happens when an SSL certificate expires?
It stops being valid after its expiry date, which OpenSSL calls notAfter, and browsers warn visitors instead of showing a secure page. Chrome’s help lists these as certificate errors, such as “Your connection is not private” and NET::ERR_CERT_DATE_INVALID.
How long does an SSL certificate last?
Let’s Encrypt certificates last 90 days by default, with no exceptions. For public certificates, the CA/Browser Forum voted to cut the longest allowed lifetime from 398 days to 47, in steps that started in March 2026.
How often should I renew a Let’s Encrypt certificate?
Let’s Encrypt recommends renewing 90-day certificates every 60 days and six-day certificates every three days. For its 45-day certificates, a fixed 60-day interval won’t do, so it suggests ACME Renewal Information or renewing about two thirds of the way through.
Will Let’s Encrypt email me before my certificate expires?
No. Let’s Encrypt has ended its expiration email service. The warning has to come from your host, your renewal tool or a check you set up yourself, like the daily one we run on our own certificates.
How can I check a certificate’s expiry date from the command line?
With OpenSSL. The x509 command’s -enddate option prints the notAfter date. Its -checkend option tells you whether the certificate expires within the number of seconds you give it, which makes it easy to use in an alert.
Sources
Read on November 4, 2026. Let’s Encrypt: FAQ, Decreasing Certificate Lifetimes to 45 Days and Expiration Emails. CA/Browser Forum: Ballot SC081v3: Introduce Schedule of Reducing Validity and Data Reuse Periods. Google Chrome Help: Check if a site’s connection is secure and Get help with common error messages in Chrome. OpenSSL: openssl-x509. Our case: our website’s certificate and our certificate watch, on November 4, 2026.