tls.cert.expiring_soon
Certificate Expiring Soon
What we check
We connect to each MX IP address over STARTTLS and calculate how many days remain until the certificate's notAfter date. If the certificate expires within 30 days, this warning fires.
What this finding means
The server's TLS certificate is valid now but will expire within 30 days. Once it expires, sending servers that verify certificates will refuse delivery, and the certificate stops proving the server's identity.
Why it matters
- Imminent risk. If renewal fails or is missed, mail delivery will break for senders enforcing certificate validation (MTA-STS, DANE).
- Automation gaps. Certificates expiring soon often indicate that automatic renewal (ACME/certbot) is broken or not configured — a problem that will recur.
- Window to act. This warning exists to give administrators enough lead time to fix the renewal pipeline before the certificate expires.
How to fix
Check your renewal pipeline. If using Let's Encrypt:
certbot certificates # shows expiry and renewal config certbot renew --dry-run # verifies renewal will succeedFix the blockage. Common causes: DNS challenge failure (stale API credentials), HTTP challenge failure (web server misconfiguration), expired ACME account, or systemd timer not enabled.
Force renewal if needed:
certbot renew --force-renewal systemctl reload postfixVerify:
openssl s_client -starttls smtp -connect mail.example.com:25 \ -servername mail.example.com 2>/dev/null | openssl x509 -noout -dates
How it's graded
An expiring certificate is a warning; it carries no point deduction in the current grading model. The penalty applies only after expiry. See Grading Methodology for the full scoring model.
Evidence example
$ openssl s_client -starttls smtp -connect mail.example.com:25 \
-servername mail.example.com 2>/dev/null | openssl x509 -noout -dates
notBefore=Jun 10 00:00:00 2026 GMT
notAfter=Sep 8 23:59:59 2026 GMT ← 12 days remaining