One of the most common questions we get asked is some variation on \u201cwhat happens when your SSL certificate expires?\u201d or \u201cwhat happens if you don\u2019t renew your SSL certificates on time?\u201d<\/span><\/p>\n\n\n The answer is death. Swift ignominious death<\/strong>. Ever wonder what happened to Jeeves? Now you know. On the death certificate his cause of death just reads: \u201ccertificate expiry.\u201d<\/p>\n\n\n\n That was a dark day for the internet\u2026<\/p>\n\n\n\n Ok, so maybe that\u2019s a little bit hyperbolic (and patently untrue – everyone knows it was Google’s wetwork). But certificate expiration can have some serious consequences. <\/p>\n\n\n\n So, today we\u2019re going to talk about what happens when your SSL certificate expires, we\u2019ll toss out some infamous examples of certificate expiration and we\u2019ll even go into how to avoid accidentally letting your SSL certificates expire in the first place.<\/p>\n\n\n\n Let\u2019s hash it out.<\/p>\n\n\n\n Let\u2019s start by answering the question we posed at the outset and then we\u2019ll delve into some of the minutiae. SSL certificates facilitate the encryption of data in transit. By installing an SSL certificate on your website\u2019s server, it allows you to host it over HTTPS and create secure, encrypted connections between your site and its visitors. This safeguards communication. SSL also authenticates the server.<\/p>\n\n\n\n SSL certificates are not valid forever though. They expire. There is an industry forum, the Certificate Authority\/Browser Forum, that serves as a de facto regulatory body for the SSL\/TLS industry. The CAB Forum legislates the baseline requirements<\/a> that Certificate Authorities must follow to issue trusted SSL certificates. Those requirements dictate that SSL certificates may have a lifespan of no longer than 27 months<\/a> (two years + you can carry over up to three months when you renew with time remaining on your previous certificate).<\/p>\n\n\n<\/span><\/span>\n\n\n That means that every website needs to renew or replace its SSL certificate at least once every two years. So, what happens when your SSL certificate expires? It makes your sight nigh unreachable.<\/p>\n\n\n\n When a user\u2019s browser arrives at your website it checks for the validity of the SSL certificate within milliseconds (it\u2019s part of the SSL handshake<\/a>). If the certificate is expired, it issues a warning like this:<\/p>\n\n\n\n You don\u2019t need me to tell you that this message is essentially a death warrant for your site\u2019s traffic, sales– whatever metric or KPI you value. While most browsers do offer an option to click through the warning, almost nobody does it. The average internet user may not know a ton about cybersecurity<\/a>, but they know two things: computers are expensive and malware messes up computers. So, if their browser tells them a website isn\u2019t safe, or in this case that their connection isn\u2019t secure, they are probably going to listen.<\/p>\n\n\n\n Wouldn\u2019t you?<\/p>\n\n\n\n This is a topic we\u2019ve discussed quite a bit in the past<\/a>, but here\u2019s a quick rundown. As we mentioned earlier, SSL certificates help facilitate two things: encryption and authentication. The latter is the bigger culprit for certificate expiry. <\/p>\n\n\n\n All SSL certificates authenticate something, even domain validation certificates authenticate a server. As with any form of authentication, you occasionally need to re-validate the information you\u2019re using in order to make sure it\u2019s accurate.<\/p>\n\n\n\n That\u2019s especially true on the internet. Things change all the time. Websites change hands. Companies are bought and sold. And SSL\/TLS is based on a trust model that can be undermined by that. So it\u2019s important for Certificate Authorities that are issuing trusted certificates to ensure that the information they\u2019re using to authenticate servers and organizations is as up-to-date and accurate as possible.<\/p>\n\n\n Let\u2019s look at a practical example. Circuit City was an electronics and appliance retailer that went out of business about a decade ago. Now, imagine for a moment that SSL certificates didn\u2019t expire. Circuit City\u2019s assets have all been sold off or jettisoned, what if someone grabs the certificate and the domain it was issued for. Now they\u2019re free to do whatever they want with that domain (until the certificate is revoked, but that\u2019s a completely separate mess) and everyone\u2019s browser would see this site as the legitimate article. Someone that didn\u2019t realize the company was now defunct could easily be duped. After all, the certificate is legitimate.<\/p>\n\n\n\n That can\u2019t happen. If anything, expect certificate lifespans to get shorter. And believe it or not – we often hear critics claim certificate expiry is a racket for the Certificate Authorities – CAs aren’t the one driving shorter validity. The browsers are.<\/p>\n\n\n\n At one point, SSL certificates could be issued for as long as five years. Then it was knocked down to three. Then last year it was down to two<\/a>\u2014which was a compromise because the original Google proposal was for one year. In the future certificate validity may be as short as 3-6 months. Let\u2019s Encrypt issues 3 month certificates right now.<\/p>\n\n\n\n Related<\/strong>: Secure Your Domain & Sub-Domains with a RapidSSL Wildcard Certificate<\/a>.<\/em><\/p>\n\n\n\n Authentication isn\u2019t the only culprit for certificate expiry though. Having shorter certificate validity periods also makes it easier for the industry to roll out changes more quickly. For instance, a few years ago the SSL\/TLS industry deprecated the use of SHA-1<\/a> as a hashing algorithm. As anyone that has ever ordered an SSL certificate knows, you pick the hashing algorithm during generation. With three year validity, in some cases you may have to wait as long as 39 months after the deadline before the certificate expires and SHA-1 is deprecated by that website.<\/p>\n\n\n\n Short validity periods fix this. If we were to phase out SHA-2 in favor of SHA-3<\/a> (don\u2019t worry, that\u2019s not coming anytime soon) you could set a cutoff date for issuing SHA-2 certificates and within 27 (or 15 if it\u2019s reduced to one year) months, SHA-2 would be completely deprecated.<\/p>\n\n\n If you do accidentally forget to renew on time and let your SSL certificate expire, you can take some solace in knowing that you are not alone. Below, we\u2019re going to keep a running list of high-profile SSL expirations:<\/p>\n\n\n\n For the second time in two years LinkedIn suffered outages in the US and UK following the expiration of one of its SSL certificates. This time the expiration affected a link shortener, lnkd.in, which rendered the site unreachable to anyone that clicked one of the shortened links (they’re typically found on social media). Link shorteners basically act like proxies, the shortened link connects with the link shortening server, gets inspected, and then gets passed along to the intended destination. And here’s the thing, this didn’t just affect LinkedIn, anyone sharing content through the site has their link shortened. Here’s an example of one of our posts with its URL shortened.<\/p>\n\n\n This is a perfect example of how an expired certificate doesn’t just harm your organization, it can also harm your customers and partners, too.<\/p>\n\n\n\n To round out 2018 and kick-start 2019, the two political parties that govern the United States decided to play a game of shutdown chicken that ended up causing the expiration of over 130 government SSL certificates, rendering dozens of sites completely unreachable. As part of a Department of Homeland Security directive from 2015, all government websites are supposed to be on the HSTS preload list<\/a>. HSTS is a security header that forces browsers to make secure connections. It’s a great idea, the only downside is if anything ever happens to your SSL\/TLS certificate, your website breaks. And by breaks I mean it becomes completely unreachable. That’s a problem when it happens to government organizations like the Department of Justice, the US Court of Appeals or NASA. <\/p>\n\n\n\n In December of 2018, millions of people in the UK were without cellular coverage following the expiration of a digital certificate associated with Ericsson\u2019s network. Ericsson, which is a Swedish cellular company, manufactures myriad back-end equipment for the world\u2019s cellular networks. Thanks to an expired digital certificate in a version of Ericsson\u2019s management software that is widely used by European telecommunications companies millions of cellular users experienced downtime.The outages initially affected software used by O2 and its parent company, Telefonica, but eventually the outages showed up downstream, too.<\/p>\n\n\n\n Equifax would have discovered the 2017 attack that compromised millions of peoples’ personal information a lot sooner if not for an expired digital certificate. For ten months, following the expiration of the certificate, Equifax couldn’t inspect the traffic running through its own network. That, in turn, caused it to miss the high-profile breach for 76 days, until the certificate was finally replaced and inspection resumed.<\/p>\n\n\n<\/span><\/span>\n\n\n\n In the first half of 2018, Cisco had an issue that superseded regular SSL certificate expiration\u2014Cisco had a root expire. As we discussed a few days ago, Roots certificates are an integral part of the SSL\/TLS trust model<\/a>. Seated at the top of the proverbial tree, Root certificates are used to sign and issue intermediates and end user SSL certificates. In this case, the root was attached to one of Cisco\u2019s VPNs, meaning every certificate it issued to end users could have potentially become invalid, too. Fortunately, that doesn\u2019t appear to have happened, users were just blocked from generating new end points.<\/p>\n\n\n The issue was resolved in APEC-EM Release 1.6.3.<\/p>\n\n\n\n Niantic seems to be having a bit of a resurgence with Pokemon Go, but back in January of 2018 the game was running into game-breaking bugs and a litany of other problems\u2014one of which was the expiration of one its SSL certificates. The outage was short, lasting just about half an hour, but it was more egg on Niantic\u2019s face at the time.<\/p>\n\n\n\n Fortunately, things seem to be going a lot better for the company lately.<\/p>\n\n\n\n The Tories, as they\u2019re known in the UK, don\u2019t have a great reputation when it comes to encryption, in general. Former home secretary Amber Rudd<\/a> and soon to be ex-Prime Minister Theresa May<\/a> have both publicly criticized encryption despite clearly not understanding very much about it. So it was ironic, then, on January 8, 2018 when the Tories\u2019 website went down following the expiration of its SSL certificate. <\/p>\n\n\n\n Or maybe you could say it Brexpired.<\/p>\n\n\n\n At the beginning of December 2017, LinkedIn allowed one of its SSL certificates to expire. It knocked out LinkedIn sites in the US, UK and Canada. As the VP of Venafi, Kevin Bocek said at the time:<\/p>\n\n\n\n “LinkedIn’s blunder demonstrates why keeping in control of certificates is so important. While LinkedIn will have thousands of certificates to keep track of, outages like yesterday’s show that it only takes one expiry to cause problems. To stay in control, organizations should look to automate the discovery, management and replacement of every single certificate on its network.”<\/p>\n<\/blockquote>\n\n\n\n LinkedIn quickly fixed the problem with a DigiCert Organization Validated SSL certificate.<\/p>\n\n\n\n In early 2017 Time Warner compounded the boneheaded oversight that let its email server’s SSL certificate expire by offering its customers some equally boneheaded advice on remedying the situation:<\/p>\n\n\n\n \u201c…going into your email settings and disabling SSL will stop the pop-up message and re-enable the webmail fetch.\u201d<\/p>\n<\/blockquote>\n\n\n\n This is terrible on so many levels. Let’s start with the fact that this is awful advice. Don’t ever disable SSL. Ever. Second, it’s incumbent upon the company that lets its SSL certificate expire to replace it in short order. It’s not the customers’ job to change their settings to compensate for that company’s negligence. Third, who the hell is still using Time Warner as an email service?<\/p>\n\n\n\n Enterprise businesses have a different set of problems when it comes to certificate management. Whereas Small and Medium Sized Businesses (SMBs) may just have one, or a handful of certificates, Enterprise companies have sprawling networks, myriad connected devices and just a lot more surface to cover in general. At the enterprise level, allowing an SSL certificate to expire is usually the result of oversight, not incompetence.<\/p>\n\n\n The best way to avoid this issue, at any level – from enterprise to the smallest mom-and-pops operation – is automation. That may sound a bit abstract, but automation has never been easier now that the ACME protocol has been published as a standard by the IETF. We covered this a few days ago, proper configuration of the ACME protocol lets you set it and forget it.<\/p>\n\n\n\n The ACME protocol works by installing a client on your server that will act as an agent for the website(s) hosted on it. Following a process where the agent proves it’s authorized to act on behalf of the designated websites, it can be configured to contact the Certificate Authority of your choice at regular intervals to replace and renew SSL certificates. Originally, only Let’s Encrypt supported this. But each day more and more CAs are adding their own support, with major players like Sectigo and DigiCert leading the way. <\/p>\n\n\n\n ACME isn’t the only choice for automation, other certificate management platforms like Venafi’s can also be set up to automate all stages of the certificate lifecycle, including those oh-so-important renewals.<\/p>\n\n\n\n We’ve got over a decade’s worth of experience helping organizations of all sizes tackle these challenges. Here’s some more actionable advice on avoiding certificate expiry in the event you’re not automating:<\/p>\n\n\n\n Forgetting to renew or replace an expiring SSL certificate can happen to anyone. But there are a lot of tools available to help minimize the risk that poses. The key, as we\u2019ve discussed, is either automation, or at least having visibility and good lines of communication so you can get out ahead of upcoming expirations. <\/p>\n\n\n\n![\"what](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/jeeves-269x300.jpg\")
<\/figure>\n<\/div>\n\n\nWhat Happens When Your SSL Certificate Expires?<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/06\/Chrome-SSL-Expired-Warning.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/06\/IE-SSL-Expired-Warning.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/06\/Firefox-SSL-Expired-Warning.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/06\/Opera-SSL-Expired-Warning.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/06\/Safari-SSL-Expired-Warning-1-1024x773.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/06\/Edge-SSL-Expired-Warning-1.png\")
<\/figure>\n<\/figure>\n\n\n\nCertificate Expiration by the Numbers<\/h3>\n\n\n\n
![\"Certificate](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2014\/02\/Certificate-Expiry-1024x288.png\")
<\/figure>\n\n\n\nWhy Do SSL Certificates Expire?<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/Certificate-Expiration-Icon-1-300x300.png\"){kind=icon}
<\/figure>\n<\/div>\n\n\n![\"expired](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/Expired-Stamp-1024x380.png\")
<\/figure>\n<\/div>\n\n\nHigh Profile SSL Certificate Expirations<\/h2>\n\n\n\n
LinkedIn let’s one of its SSL\/TLS certificates expire… again!<\/strong><\/a><\/h3>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/shortened-url.png\")
<\/figure>\n<\/div>\n\n\nUS Government shutdown causes dozens of SSL certificate expirations<\/strong><\/a><\/h3>\n\n\n\n
Ericsson lets certificate expire, 32 million people lose cellular service<\/strong><\/a><\/h3>\n\n\n\n
Equifax misses a breach for 76 days because of an expired certificate<\/strong><\/a><\/h3>\n\n\n\n
Cisco lets one of its SSL certificates expire<\/a><\/strong><\/h3>\n\n\n\n
![\"Pokeball\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/Poke-Ball-300x300.jpg\")
<\/figure>\n<\/div>\n\n\nPokemon Go lets its SSL certificate expire<\/a><\/strong><\/h3>\n\n\n\n
The UK Conservative Party lets its SSL Certificate Expire<\/a><\/strong><\/h3>\n\n\n\n
LinkedIn lets its SSL Certificate Expire<\/a><\/strong><\/h3>\n\n\n\n
\n
Time Warner lets its Mail Server’s SSL certificate expire<\/a><\/strong><\/h3>\n\n\n\n
\n
How to Avoid Letting Your SSL Certificate Expire<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/12\/Expired-Cert-300x300.png\")
<\/figure>\n<\/div>\n\n\n\n
So, that\u2019s what happens when your SSL certificate expires<\/h2>\n\n\n\n
![\"Hashed](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568-1024x267.jpg\")
<\/figure>\n","protected":false},"excerpt":{"rendered":"