Don't Let Your Domain Expire: Monitoring Domain and Certificate Renewals

Quick answer
An expired domain or TLS certificate takes your site down with no code change — and often no warning.
Registrars and certificate authorities warn you by email, but that email can miss you or land in spam.
Add an external expiry check that alerts on a channel you actually see, with a 30-day lead time.

How do domains and certificates expire?

Domain registrations are rented by the year; TLS certificates are valid for about 90 days (Let’s Encrypt) to a year (paid CAs). When either expires, the failure is immediate and total: an expired domain stops resolving and email stops working; an expired certificate makes browsers show a full-page security warning that scares users away. Both renew on autopilot when configured — the danger is the configuration that lapsed: a card that expired, a renewal email in spam, or a certificate that was only ever installed manually.

How do I set up expiry alerts?

Three layers, cheapest first. Set renewal reminders in your registrar’s dashboard (most default to 30 days before). Add a free domain-expiry check from a monitoring service that queries WHOIS and alerts on a schedule — 30, 14, and 7 days out. For certificates, services like UptimeRobot and Better Stack check TLS expiry alongside uptime. One external monitor covers both: it verifies the certificate is valid and unexpired with every check.

# Check a certificate's expiry date from the command line
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null |
  openssl x509 -noout -enddate
# notAfter=Sep 12 12:00:00 2026 GMT   <- renew before this date

What does a healthy setup look like?

Auto-renewal is on for both the domain (registrar setting, valid payment method) and certificates (certbot renew timer or managed platform), and an external monitor confirms both from outside — because your own server’s checks can’t catch ‘the registrar didn’t renew’ or ‘the CDN is serving a stale cert’. Alert thresholds: 30 days before domain expiry, 14 days before certificate expiry, and an immediate alert if a check finds an invalid or expired certificate.

Where this bites vibecoders
The most humbling outage a vibecoder can have: the site was ‘fine’ but the domain lapsed because the AI assistant set up the hosting and nobody owned the renewal. Assistants configure infrastructure, not billing calendars, and vibecoders usually have auto-renew on — until a card expires. A 30-day external alert converts ‘discovered by users’ into ‘renewed over coffee’. It’s five minutes of setup for an outage class that needs zero code changes to happen.

Where AI coding assistants get this wrong

Setting up HTTPS with a manual certificate install and no renewal path, guaranteeing a 90-day expiry.
Assuming the registrar’s email reminder is enough, when it can sit in spam for a month.
No external check, so ‘the server says the cert is fine’ misses a broken renewal chain.
Forgetting that email, DNS, and the site all die together with the domain — one expiry, three outages.

Checklist

Enable auto-renewal on the domain with a valid payment method on file.
Set up certificate auto-renewal (certbot timer or managed platform).
Add an external monitor that checks domain WHOIS and TLS expiry, alerting at 30/14/7 days.
Test the alert once by checking a domain you know expires soon.

FAQ

How early should I renew my domain?

Any time after it’s within the renewal window — registrars typically allow renewal up to a year in advance, and most sites renew annually. The key habit is auto-renewal plus a 30-day alert, so a card problem surfaces while there’s still time to fix it.

Can I recover an expired domain?

Usually, but it gets expensive and slow: after expiry there’s a grace period (roughly 30-45 days) where you can renew at normal price, then a redemption period where recovery costs much more, then the domain is released to the open market. Recovery is possible — but the alert is cheaper.