How to track domain and SSL expiry dates for all your clients

Two dates can take a client's website offline overnight: the day the domain registration ends and the day the SSL certificate expires. Both are set months in advance, both come with warning emails, and both still lapse regularly.

This guide explains why that happens and gives you a process that keeps every client's dates in front of you.

Why do domains and SSL certificates expire without anyone noticing?

The warnings exist. They go to the wrong place.

• The notice goes to an old inbox. The renewal reminder is sent to whoever registered the domain, often a previous agency, a former employee or the freelancer who set it up years ago.
• The payment method has changed. Auto-renew works until the card on file expires or is replaced.
• Nobody owns the account. When the registrar login belongs to a person who has left, nobody can renew.
• Certificates renew automatically, until they do not. Automatic issuance depends on a DNS record, a validation file or a hosting plan staying in place. When one of them changes, renewal fails quietly.
• There are many of them. Five clients with a few subdomains each is dozens of dates, and nobody remembers dozens of dates.

How do I check when a domain expires?

Registries publish registration data through RDAP, the standard that replaces WHOIS. The expiration date is one of the events in the response. From a terminal:

curl -sL https://rdap.org/domain/example.com | jq '.events[] | select(.eventAction=="expiration")'

The eventDate field is the expiry date. Two limits to know:

• Some country-code domains do not publish expiry data through RDAP. For those you need the date from the registrar account.
• The public record shows the registry's date, which is the one that counts, but it does not show whether auto-renew is switched on.

How do I check when an SSL certificate expires?

Connect to the site and read the certificate:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -enddate

The output is the date the certificate stops being valid. Check every hostname that serves a site, because a certificate for the main domain does not cover a staging site or a shop on another subdomain.

How long do SSL certificates last now?

Shorter every year. Public certificates are being limited in stages: 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. Confirm the current schedule with the CA/Browser Forum before you plan around exact dates. The direction is clear, though. A reminder in a calendar once a year is no longer enough, and renewal has to be automated and watched.

What happens when a domain expires?

The exact timing depends on the registry and the registrar, but the pattern is the same.

1. Expiry. The domain stops resolving once the registrar removes its records, and email to the domain starts bouncing.
2. Grace period. Many registrars let the owner renew at the normal price for a short time after expiry.
3. Redemption period. The owner can still recover the domain, usually for a much higher fee.
4. Release. After that the domain can be registered by anyone, who may then receive email meant for your client.

Recovery is also slow, because DNS changes take time to spread, so a domain that is renewed on the last day can still be unreachable for some visitors for a while.

A process that works for several clients

1. Make an inventory. One row per hostname: client, domain, registrar, certificate hostnames, who owns the registrar login and where renewal notices are sent.
2. Fix ownership first. For every domain, confirm that a notice reaches an inbox that is read, and that someone other than a single person can recover the account.
3. Record both dates. Store the domain expiry and the certificate expiry in one place, along with whether renewal is automatic.
4. Set alerts with lead time. Warn at 60 and 30 days for domains. For certificates, alert a week before the date and again in the last few days. Automatic renewal normally happens well before expiry, so a certificate that is close to its end date usually means renewal has already failed.
5. Review monthly. Sort by date and look at anything due in the next 60 days, plus anything with no date, which means the lookup is failing.
6. Close the loop with the client. Tell them once that renewals are tracked and whose card is on file. It prevents most surprises.

What should I track besides domains and certificates?

The same failure applies to anything that renews: hosting plans, API tokens, third-party subscriptions, email service plans and the contracts behind them. If it can expire and take something down, it belongs on the same list.

Where Datumboard fits

Doing this by hand works for a handful of sites and breaks as the list grows. Datumboard reads certificate and domain dates for the sites you add, puts them in one renewal calendar next to the tokens, subscriptions and contracts you enter by hand, and shows Not available when a date cannot be read instead of pretending everything is fine. It is in early access, and you can join the list below.