Defaults.Exposed › October 2026 census › v10 registry › Certificate expiry
Certificate expiry
Methodology v10 · canonical ID cert-expiry-warning · TLS (Transport Layer Security) & Certificates · scored
A certificate about to expire takes your site offline with a full-page warning.
Certificate expiry: definition
| Canonical ID | cert-expiry-warning |
|---|---|
| Category | TLS & Certificates |
| Grade impact | Scored, counts toward the grade |
| Pass | The certificate's notAfter date is comfortably in the future (not expired, not inside the imminent-expiry window). |
| Fail | The certificate is expired or expires imminently. |
| Example (passing) | Not After: a date well beyond the scan date |
Certificate expiry across the census
95.8% of domains whose certificate expiry date could be read present a certificate that is neither expired nor about to expire (210,902,471 of 220,258,401, as of October 12, 2026).
Aggregates only: never an individual domain's result.
How this check is scored
Certificate expiry is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 112,233,918 of the 332,492,319 graded domains had no determinable result for this check: the expiry date has to be read from a presented certificate, so domains without a readable certificate are outside its base.
Every outcome in the census
| Outcome | Domains | Share of domains whose certificate expiry date could be read | In the headline figure |
|---|---|---|---|
| Not expired and outside the imminent-expiry window | 210,902,471 | 95.8% | Yes |
| Expired, or inside the imminent-expiry window | 9,355,930 | 4.25% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
Against the other checks
Among the 6 TLS & Certificates checks with a published figure, Certificate expiry has the 4th highest pass share. Next above it is Signature algorithm: 99.6% of domains whose certificate signature algorithm could be read. Next below it is Certificate valid: 89.2% of HTTPS-serving domains. Across every check with a published figure it ranks 6th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix TLS certificate health
Cite this check
Defaults.Exposed, "Certificate expiry (cert-expiry-warning)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/cert-expiry-warning
Permalink: https://defaults.exposed/methodology/cert-expiry-warning ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data