# How Early Should You Alert on Certificate Expiration?
Expiration alerts should fire when you still have business days to fix the issue, not when the cert already expired. Layer thresholds at thirty, fourteen, and seven days for most SaaS products.
Author: fajita-editorial
Published: 2026-07-17
Updated: 2026-07-17
Last reviewed: 2026-07-17
Version: 1
Canonical: https://fajita.io/blog/how-early-should-you-alert-on-certificate-expiration
Certificate expiration incidents are embarrassing because they are predictable. The fix is not checking once. The fix is alerting early enough that renewal fits normal work, not an emergency deploy during a holiday.

## Recommended alert ladder

| Days remaining | Purpose |
| --- | --- |
| 30 days | Create renewal ticket, verify auto-renew is enabled |
| 14 days | Confirm new cert is issued and staged |
| 7 days | Page if production still serves old expiry |
| 1 day | Critical page to on-call with deploy authority |

Adjust shorter if your CA or DNS validation routinely takes multiple days. Adjust longer if you manage hundreds of certs manually.

## Separate warning from outage

- Expiration warning is not the same as TLS handshake failure
- Monitor the served certificate on the public hostname customers use
- Track both apex and www if both serve traffic
- Include status page custom domains in the same program

## Operational habits that prevent surprises

1. Prefer automated ACME renewal where possible
2. Document who can approve DNS validation records
3. Test staging deploy after every renewal
4. Keep a runbook link in the alert message

When an alert fires at thirty days, someone should be able to answer whether auto-renew is on and which provider issues the cert. If that answer is unclear, fix ownership before the seven day alert.

Document the renewal owner in the same place you document on-call rotation. Certificate incidents happen on weekends because expiry dates ignore business hours.

## Testing alerts without waiting a month

Create a staging hostname with a short-lived test certificate or use your provider's sandbox to verify alerts reach the right channel. An untested expiration monitor is just calendar hope.
Original contribution: 30/14/7/1 day TLS expiration alert ladder with operational follow-up actions.