Is an alert before expiry not enough?

An alert is necessary but not sufficient; if renewal and installation are still done by hand after the alert, the margin for error remains. Alerts should be the backup for verified automatic renewal.

Who tracks the expiry of root and intermediate certificates?

Certificate authorities announce it; on the organisation's side, trust stores (operating systems, applications, devices) must be kept current.

Guide

How expensive is an expired certificate? Outages on the public record

A single expired certificate stops everything behind it. The incidents below come from public reports; what they share is that nobody tracked where the certificate was installed and when it would expire.

2 September 2026 · 5 min read

Incidents

Microsoft Teams, February 2020: On 3 February 2020 Teams was unreachable worldwide for hours; Microsoft said the cause was an expired authentication certificate.
Spotify, August 2020: On 19 August 2020 Spotify went down for about an hour; the company named an expired TLS certificate as the cause.
Ericsson, December 2018: On 6 December 2018 mobile data networks of many operators, including O2 in the UK and SoftBank in Japan, went down; Ericsson confirmed an expired certificate in core network software. Millions of subscribers were affected for hours.
Let's Encrypt root certificate, September 2021: On 30 September 2021 the old DST Root CA X3 expired; older devices and software with outdated root lists stopped trusting valid certificates. The problem was not the certificate but chain and trust store management.
Equifax, 2017: According to US government reports, the certificate on a device inspecting network traffic had expired and was left unrenewed for months, which is why the data breach went unnoticed for months.

Shared lessons

The certificate was known to exist; where it was installed and when it would expire was not tracked.
Renewal depended on human memory or a calendar reminder.
The outage started with one certificate and spread to every service behind it.
Chain and root management are part of certificate management; watching only the leaf is not enough.

How 47 days changes this

A risk faced once a year today will be faced eight times a year per certificate in 2029. With manual renewal the chance of missing one grows in proportion; automation and verified installation are the only scalable way to keep these incidents from repeating.

Frequently asked questions

Is an alert before expiry not enough?: An alert is necessary but not sufficient; if renewal and installation are still done by hand after the alert, the margin for error remains. Alerts should be the backup for verified automatic renewal.
Who tracks the expiry of root and intermediate certificates?: Certificate authorities announce it; on the organisation's side, trust stores (operating systems, applications, devices) must be kept current.

Sources

Let's Encrypt · DST Root CA X3 expiration (September 2021)
Other incidents: the companies' public status pages and press coverage of the time (2017–2020)

Manage your certificates in one place

Inventory, expiry tracking, renewal through ACME and verified installation, on your own infrastructure.

Request a demo