How to fix ssl expiry on Headless / Custom (I build in code)

Steps for Headless / Custom (I build in code)

1. Use Certbot (Let's Encrypt) for free, automated certificate management: install via your package manager and run `sudo certbot --nginx` or `sudo certbot --apache` for automatic configuration.
2. Enable the systemd renewal timer: `sudo systemctl enable --now certbot.timer` and verify with `sudo systemctl status certbot.timer`.
3. For containerised/cloud setups, use a sidecar like cert-manager (Kubernetes) or AWS Certificate Manager (ACM), which handle issuance and renewal automatically.
4. Add a monitoring alert (e.g., UptimeRobot's SSL monitor, or a cron that emails you) to notify you if a certificate is within 21 days of expiry.
5. For CDN-fronted architectures (Cloudflare, CloudFront), provision a certificate at the CDN edge layer as well as the origin, and verify both are renewed.

What is ssl expiry?

A TLS (SSL) certificate is the digital credential that puts the padlock in your visitors' browser bar and enables the secure "https://" connection to your store. Every certificate has an expiry date — typically 90 days (Let's Encrypt) or 1–2 years (paid CAs). When it expires, browsers immediately block visitors with a full-screen "Your connection is not private" warning, and the padlock disappears. Auto-renewal is a process (a scheduled script or a hosting feature) that requests a fresh certificate a few weeks before the old one expires, so the swap happens invisibly to shoppers.

An expired certificate is an emergency: every visitor sees a hard browser warning and most will leave instantly, causing an immediate and total loss of sales. Google also uses HTTPS as a ranking signal, so a lapsed certificate can drop your organic rankings. Payment processors and card networks require an active TLS certificate — an expired cert can cause checkout failures and put you in breach of PCI-DSS compliance. Setting up auto-renewal costs nothing and takes minutes; ignoring it risks hours or days of complete store downtime.

See the complete Ssl expiry guide for every platform and the full background.