# What happens when a TLS certificate expires?

Clients stop trusting the server: browsers show a full-page warning, and apps, APIs, VPN clients and devices usually refuse to connect at all. To users it looks like an outage, and in practice it is one: payment pages, customer portals, mail servers and machine-to-machine links can stop working at the moment of expiry, often at night or over a weekend. Expired certificates also train staff to click through warnings, which is exactly what an attacker intercepting traffic would want. The fix is process, not heroics: an inventory of every certificate with its owner and expiry date, alerts well in advance, and automatic renewal through the ACME protocol (RFC 8555) wherever the platform supports it. Do not forget certificates inside appliances, printers, internal services and code signing, which external scanners never see. Watching TLS handshakes on the internal network helps find servers that nobody listed, though in TLS 1.3 the certificate itself is encrypted and must be checked on the server.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/what-happens-when-a-tls-certificate-expires

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Why are TLS certificate lifetimes getting shorter?](https://netsenx.com/en/faq/why-are-tls-certificate-lifetimes-getting-shorter)
- [Are self-signed certificates on internal servers a problem?](https://netsenx.com/en/faq/are-self-signed-certificates-on-internal-servers-a-problem)
- [What is mutual TLS (mTLS)?](https://netsenx.com/en/faq/what-is-mutual-tls)
- [Does a VPN encrypt everything we send?](https://netsenx.com/en/faq/does-a-vpn-encrypt-everything-we-send)
- [How do I find all SSH servers on our network, including forgotten ones?](https://netsenx.com/en/faq/how-to-find-all-ssh-servers-on-the-network)