Revocation & Validity
What Is Expired Certificate?
An expired certificate is one whose notAfter date has passed: clients treat it as invalid immediately, with no grace period. Expiry is not an edge case — it is the single most common cause of certificate-related outages, taking down websites, APIs, mobile apps and machine-to-machine authentication with a fully predictable failure that was known years in advance.
What breaks, exactly
Browsers show hard warnings (NET::ERR_CERT_DATE_INVALID); API clients and mobile apps fail closed with handshake errors; mTLS peers reject connections; and signed artifacts (code, documents) may stop validating depending on timestamping. Famous incidents — Microsoft Teams 2020, Spotify 2020, the Starlink outage 2023 — were all just expiry.
Watch the whole chain: an expired intermediate or root fails every certificate under it at once (the Let’s Encrypt DST Root X3 expiry in 2021 broke millions of older devices), and an expired CRL or OCSP signer can have the same blast radius.
Why it keeps happening
Certificates outlive the person who installed them; renewals live in calendars instead of systems; and the certificate actually served is not always the one renewed (load balancers, CDNs and containers each hold copies). Shrinking maximum lifetimes — 398 days today, headed toward 47 days by 2029 — turn manual renewal from risky into impossible.
Making expiry a non-event
Inventory every certificate (including internal ones), monitor what is really served in production, alert at 30 days with an owner attached, and automate issuance where possible (ACME). Expiry is the most preventable outage in IT — everything needed is known in advance.
Try it yourself — free tools
- Certificate Checker — see the exact expiry of any live site or certificate file — and subscribe to expiry alerts
- CRL Checker — watch CRL expiry, the other clock that takes systems down
How MI Support IT can help
PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.
PKI Glossary
- Certificate Lifecycle Management (CLM)The discipline — and tooling — that keeps hundreds of certificates issued, deployed, renewed and revoked without outages.
- Certificate Revocation List (CRL)The CA-signed list of revoked certificates — and the single file whose expiry can take down an entire PKI.
- Certificate Chain (Intermediate Certificates)How leaf, intermediate and root certificates link together — and why a missing intermediate breaks TLS.
- Browse all terms →