webzod
account

Use a certificate with a standard validity period

tls.names.validity_too_long · effort: about an hour

Why it matters

The certificate is valid for longer than the CA/Browser Forum rules allowed on its issue date, so it was misissued and the CA must revoke it, which will break HTTPS without warning. Short lifetimes also limit the harm if a key leaks.

The fix

  1. Replace it now and tell the issuing CA. Check where the certificate came from first, because a public CA should not issue beyond the allowed lifetime, so this usually means a non-compliant CA or a certificate that was misissued.
  2. Get the replacement from a public CA and automate renewal with an ACME client so you never handle expiry by hand.
  3. Re-issue on a schedule that follows the CA's lifetime. Maximum lifetimes are being reduced in steps, so manual yearly renewal will stop working.
bash 
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -issuer

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.