TLS certificate is not about to expire

What this means

Passing means the certificate your site presents on port 443 has more than 14 days left. Failing means it has 14 days or fewer, has already expired, or the handshake does not complete at all. On a host like Vercel the certificate renews itself, so a short remaining life usually means the host can no longer renew it rather than that someone forgot.

How we test it

We open a TLS handshake to your domain on port 443 and read the certificate's expiry date. More than 14 days remaining is a pass. Fourteen days or fewer, an expired certificate, or a failed handshake is a fail; there is no warn state. This is a passive check.

Why it matters

An expired certificate takes the site down for everyone at once. Every browser shows a full-page warning, every API client refuses the connection, and webhooks from your payment provider stop being delivered. The Module 00 notes list the usual reasons a host stops renewing: the A or CNAME record no longer matches what the host asked for, or the Cloudflare proxy is turned on in front of a host that terminates TLS itself. The Fix Kit does not have a dedicated runbook for certificate monitoring, so the fix below stays short.

The fix

In Vercel, Settings, Domains, get the domain back to Valid Configuration with the certificate check green: the A and CNAME records must match exactly what Vercel shows and be set to DNS only (grey cloud) so the host can renew, and no CAA record may exclude its authority. If you terminate TLS somewhere other than your host, renew the certificate there before the 14-day mark.

The full runbook is in the Fix Kit, Module 07.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not renew or change anything. Run:
echo | openssl s_client -connect YOUR_DOMAIN:443 -servername YOUR_DOMAIN 2>/dev/null | openssl x509 -noout -dates -issuer
Show me the notAfter date and the issuer, and tell me how many days remain.
Run: dig +short A YOUR_DOMAIN and dig +short CNAME www.YOUR_DOMAIN and tell me whether they match the host's records.
Run: dig +short CAA YOUR_DOMAIN and tell me whether any CAA record would exclude that issuer.
Run: curl -sI https://YOUR_DOMAIN | head -1 and show the status line.
Tell me whether the host can still renew this certificate and what it would take if not. Stop there.
Finally run: echo | openssl s_client -connect YOUR_DOMAIN:443 -servername YOUR_DOMAIN 2>/dev/null | openssl x509 -noout -checkend 1209600; echo $? and show the exit code. Expected 0, meaning more than 14 days remain.