TLS certificate is expired or close to expiry
The certificate presented by the scanned origin was expired or within ShipReady's renewal-warning window.
Why it matters
A certificate that expires can interrupt browser access, API clients, webhooks, and other TLS connections. Renewal should be completed before the expiry window closes.
How ShipReady detects it
What it inspects
ShipReady opens a TLS connection to the origin and reads the presented certificate's validity end date.
What triggers a finding
The rule triggers when the certificate is already expired or its remaining validity is within the scanner's configured warning period.
What the evidence shows
The certificate presented to the scanner had the recorded expiration date and was expired or within the warning window at scan time.
Limits of this check
The scanner checks the origin it reached at scan time. It does not prove that every hostname, CDN edge, client trust store, or future renewal path will behave the same way.
How to fix it
Renew or replace the certificate
Renew the certificate through the current issuer or managed host before expiry. Confirm the certificate covers the public hostname served by the origin.
Check renewal automation
Investigate any failed challenge, deployment, or DNS step and add expiry monitoring with enough lead time to repair it.
How to verify the change
Verify the public certificate date
Perform a fresh TLS handshake to the public hostname after the renewal deploy.
Expected: The presented certificate validates and its expiry date is outside the warning period.