tls.cert.expired

Certificate Expired

What we check

We connect to each MX IP address over STARTTLS and inspect the presented certificate's notAfter field — the date and time after which the certificate authority declares the certificate invalid.

What this finding means

The server's TLS certificate has expired. Every certificate has a fixed validity window (notBefore to notAfter); once notAfter passes, the certificate is no longer considered trustworthy by any standards-compliant verifier.

Why it matters

Delivery failures. Sending servers that verify certificates (MTA-STS enforce, DANE) will refuse to deliver mail to an expired certificate. Even opportunistic TLS implementations may log warnings or fall back to plaintext.
No identity assurance. An expired certificate proves nothing about the server's identity — a certificate authority could have revoked and reissued it to a different party.
Trust signal. An expired certificate is one of the most visible indicators of a neglected mail infrastructure and is the single highest TLS penalty in the grading model.

How to fix

Renew the certificate. If you use Let's Encrypt or another ACME-based CA, the renewal is usually automatic — check that the renewal timer or cron job is still running:
```
# Check certbot timer
systemctl status certbot.timer

# Force a renewal test
certbot renew --dry-run
```
Reload the mail server after renewal so it picks up the new certificate. Most mail servers (Postfix, Exim, Dovecot) need a reload, not a restart:
```
systemctl reload postfix
```

Verify the new certificate:

openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com 2>/dev/null | openssl x509 -noout -dates

Automate monitoring. Set a calendar alert or use a monitoring tool to catch certificates before they expire — 30 days is a common lead time.

How it's graded

An expired certificate carries a –30 penalty and triggers an instant F grade for the TLS category. See Grading Methodology for the full scoring model.

Evidence example

$ openssl s_client -starttls smtp -connect mail.example.com:25 \
    -servername mail.example.com 2>/dev/null | openssl x509 -noout -dates
notBefore=Jan  5 00:00:00 2025 GMT
notAfter=Apr  5 23:59:59 2025 GMT    ← expired