What happens when a TLS certificate expires?

Clients stop trusting the server: browsers show a full-page warning, and apps, APIs, VPN clients and devices usually refuse to connect at all. To users it looks like an outage, and in practice it is one: payment pages, customer portals, mail servers and machine-to-machine links can stop working at the moment of expiry, often at night or over a weekend. Expired certificates also train staff to click through warnings, which is exactly what an attacker intercepting traffic would want. The fix is process, not heroics: an inventory of every certificate with its owner and expiry date, alerts well in advance, and automatic renewal through the ACME protocol (RFC 8555) wherever the platform supports it. Do not forget certificates inside appliances, printers, internal services and code signing, which external scanners never see. Watching TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshakes on the internal network helps find servers that nobody listed, though in TLS 1.3 the certificate itself is encrypted and must be checked on the server.

← All 40 questions on Encryption and encrypted trafficAll topics