Public TLS certificate approaching expiry without automated renewal

A TLS certificate near expiry with no automated renewal path in place is an outage waiting to happen. When the certificate expires, browsers surface a full-page warning and refuse to load the site by default, mail servers fail to negotiate TLS for STARTTLS on port 25, and API integrations break. ## Why attackers exploit it Directly, they don't need to. Indirectly, an expired certificate creates the exact user-training condition attackers benefit from: users learn to click through browser warnings, which primes them to click through the warnings that actually protect against phishing sites and man-in-the-middle attacks. ## Remediation direction Every internet-facing TLS certificate on ACME auto-renewal (Let's Encrypt, ZeroSSL) with monitoring on the renewal cron. For appliances that can't use ACME, calendar reminders 60 and 30 days before expiry plus a renewal-owner named in the reminder. Audit the whole cert inventory quarterly, not just the ones the ops team remembers.