Skip to content
DevMarDe
Crawl Audit check 142Crawl AuditSecurity

Certificate expiry warnings: Crawl Audit check 142

Crawl Audit check 142 warns when your SSL certificate has 30 days or less left. Why lifetimes drop to 47 days by 2029, and how to renew automatically.

Zain Kazmi2 min read
On this page
  1. What Crawl Audit checks
  2. Lifetimes are shrinking
  3. Renewing automatically
  4. On devmarde.com
  5. Sources
Check
142 of 200
Module
Security & Infrastructure
Group
SSL/TLS & Encryption Standard
Impact
High

Short answer: every certificate has an end date, and an expired one triggers the same browser warning as having none. Certificate lifetimes are getting shorter, so renewal needs to be automatic. Check 142 warns when yours has 30 days or less left.

What Crawl Audit checks

  • Pass: more than 30 days left. The report shows how many.
  • Warning: 0 to 30 days left.
  • Fail: the certificate has expired.
  • If the date can't be read, an HTTPS site passes with a reminder to turn on auto-renewal.

Lifetimes are shrinking

  • The CA/Browser Forum, which sets the rules certificate authorities follow, voted in 2025 to cut the maximum lifetime from 398 days to 200 days for certificates issued from 15 March 2026, 100 days from 15 March 2027, and 47 days from 15 March 2029.
  • Let's Encrypt issues 90-day certificates today. Its default moves to 64 days on 10 February 2027 and to 45 days on 16 February 2028.
  • Let's Encrypt: "Manually renewing certificates is not recommended, as it will need to be done more frequently with shorter certificate lifetimes."

One knock-on effect: with 64-day and then 45-day certificates, a healthy auto-renewing site will regularly sit under 30 days. When that happens, a warning here means "confirm renewal is set up", not "something is broken".

Renewing automatically

  • Let's Encrypt suggests renewing "at approximately two thirds of the way through the current certificate's lifetime".
  • It also recommends ACME Renewal Information (ARI, now RFC 9773), which lets the certificate authority tell your client when to renew.
  • Managed hosts usually renew for you. If you run your own server, check that the renewal job actually runs, and add an expiry alert as a backstop.

On devmarde.com

Our certificate was issued on 14 September and runs to 13 December 2026: 68 days left on 6 October, so it passes.

Sources

All 200 Crawl Audit checks

See how your site does on every check.

Crawl Audit runs this check and 199 others on your domain. The full report is $7.89, one time. The free check on this site covers 25.

Run Crawl Audit · $7.89Free AI visibility check