TLS | XB Field Notes

A green validity interval includes filled notBefore and notAfter endpoints; times outside are crossed out. A second example fails at hour four because the issuer expired at hour three while the leaf lasts six hours.

A TLS certificate expiry is a date you can read

A certificate’s expiry is a deadline for certificate validation, not a timer that necessarily closes every existing connection. Read the certificate actually served to the intended hostname, then distinguish its validity window from the rest of the trust decision. A future notAfter date alone does not establish that HTTPS is healthy. ...

An illustrative effective CAA policy, issue letsencrypt.org, branches into CAA permits for an authorized CA and CAA blocks for an unauthorized CA. Existing certificates are unchanged.

CAA records should authorize the issuer you actually use

CAA narrows certificate issuance policy, but a mistaken record can block renewal as effectively as an expired certificate.

Expiry evidence consists of notAfter and a chosen threshold. Separate verification asks about name, chain, and trust. SNI selects the virtual host and does not validate its certificate.

Certificate expiry is a date, not a dashboard color

Use SNI, inspect the public certificate, and alert before renewal becomes an incident.

The server sends the leaf and needed intermediates; the client builds a path to its own trust anchor and also checks hostname and validity.

A certificate chain is a path you should be able to print

Read the chain the edge actually presents, not just the leaf, before you trust the rollout.