Scan rule · RSC-SEC-090
TLS certificate about to expire
Reads the host's certificate and reports when it expires in 14 days or fewer.
Why this matters
Certificates expire, that is normal — every 90 days with Let's Encrypt. What is also normal is renewal running automatically without anyone noticing. A certificate with two weeks left is therefore usually a sign that this automation is missing or stuck.
The window is the opportunity: today it is a calendar entry, in 14 days it is a browser warning for every visitor. On hosts with built-in certificates (Vercel, Netlify, Cloudflare) a look at the domain settings usually suffices; on your own server run `certbot renew --dry-run`.
Check it yourself: click the padlock in the address bar → certificate → “Valid until”.
Scan tier
How to fix it
Renew the certificate before it expires and verify or set up automatic renewal.