# Is your site certificate about to expire?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

The certificate expiry check warns when your site certificate expires within a month. Here is what to check so renewal does not lock visitors out.

The certificate expiry check warns when the certificate your site presents expires within the next month. When a certificate lapses, browsers show a full-page warning instead of your site.

## What does this check look at?

It looks at whether your site certificate expires within the next month. Your site needs a certificate, a small file that proves to browsers that they reached the real site. Most hosts issue and renew one for you.

Pulse and Deep scans both run it.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| No finding | The certificate is not close to expiry. | Nothing. |
| Low finding | The certificate expires within a month. | Confirm renewal is automatic and working. |

Automatic renewal may already be set up, and the renewal job is not inspected. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

### What does a confirmed finding have to show?

| Part | For this check |
| --- | --- |
| Where it starts | Every visitor's browser |
| The protection that should stop it | Certificate renewal before expiry |
| What is reached | A browser warning once the certificate expires |
| What follows | Visitors blocked, or taught to click through warnings |

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A04:2025` Cryptographic Failures |
| CWE | `CWE-298` |
| ASVS | `v5.0.0-12.2.2` |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

Most of the time the fix is confirming automatic renewal, not doing anything by hand.

:::fix-prompt any
My site certificate expires soon. Find out who issues and renews it (my host, CDN or a certificate tool on my server). Confirm automatic renewal is turned on and that its last renewal attempt succeeded, and tell me how to get an alert if renewal fails. If renewal is manual, give me the exact steps to renew it now.
:::

## How to check

Say Atlas, our example app at `atlas.example`, runs on a server with a certificate a teammate set up by hand. The check flags it three weeks before expiry, in time to switch to automatic renewal.

The free [quick check](/check) covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains the difference.

## Questions people ask

### My host renews certificates automatically. Why did this flag?

Automatic renewal usually starts close to the expiry date, so a warning can appear just before it runs. Check again after renewal to clear it.

### What happens if the certificate expires?

Browsers block the site with a warning page, and visitors who click through learn to ignore warnings, which is worse.

## Sources

- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [The lock in the address bar](https://www.lockpick.app/docs/learn/the-lock-in-the-address-bar), Lockpick docs, read on 2026-10-07