Domain expiration and SSL expiry, owned and tracked across every brand.
Domain expiration takes a website and its email down, and a lapsed certificate puts a browser warning in front of every visitor. Both are dated, both are predictable, and both are missed when the registrar account, the card or the reminder email belongs to someone who has left. ExpiryEdge gives every domain, certificate and IT subscription a named owner and reminders at 90, 60, 30 and 7 days.
Last updated · ExpiryEdge editorial team
Every domain, certificate and IT subscription with an owner and a date
Current, legacy and defensive domains in one register
Manual certificates flagged as shorter lifetimes arrive
Registrar account, card and contact email checked before renewal
Firewall, Wi-Fi and SaaS subscriptions on the same dashboard
Quick answer
Domain expiration does not mean instant loss, but the website and email can stop on the day. For gTLDs such as .com, ICANN requires registrars to warn you about one month and one week before expiry, and the registry offers a 30-day redemption period after deletion, at a restore fee. Give every domain an owner and a 90-day reminder.
What an IT team keeps current
Domains for the current brand and product names
Legacy domains still redirecting after a rebrand
Defensive and typo domains
Country-code domains (.uk, .de, .eu) under their own registry rules
Wildcard and multi-domain TLS certificates
Certificates on load balancers, VPNs and appliances
Registrar accounts, payment cards and contact emails
DNS hosting and CDN plans
Firewall security subscriptions and support contracts
Wi-Fi and network licences
SaaS subscriptions and seat counts
Hardware warranties and support renewals
Who uses it for domains and certificates
IT managers
Hold the domains, certificates and subscriptions for the whole business and want one list of what renews next, with an owner on each line.
Platform and web engineers
Automate what ACME can renew and need a reminder for the certificates on appliances, legacy servers and third-party platforms that it cannot.
Marketing and brand teams
Register campaign and product domains, and after a rebrand still depend on the old domains redirecting and receiving email.
Security and compliance leads
Need evidence that certificates, firewall subscriptions and security services stayed current, with a history of who renewed what.
Managed service providers
Track the same items across every client, grouped by client, with alerts in Slack or Teams.
Domain expiration, stage by stage (gTLDs such as .com)
| What happens | Source | Last verified | |
|---|---|---|---|
| About one month before expiry | Registrar must send the first expiry notice (ICANN treats 26 to 35 days before as compliant) | icann.org/resources/pages/errp-2024-02-21-en (2.1.1) | 12 Oct 2026 |
| About one week before expiry | Registrar must send a second notice (4 to 10 days before) | icann.org/resources/pages/errp-2024-02-21-en (2.1.1) | 12 Oct 2026 |
| Expiry day onwards | Registrar may delete the registration at any time after expiry. While the name is still renewable, DNS must be interrupted for at least the last 8 days, so the site and email stop | icann.org/resources/pages/errp-2024-02-21-en (2.2.1 to 2.2.5) | 12 Oct 2026 |
| Within 5 days after expiry | If not renewed or deleted, the registrar must send one more notice with renewal instructions | icann.org/resources/pages/errp-2024-02-21-en (2.1.2) | 12 Oct 2026 |
| Up to 45 days after expiry (.com) | Auto-Renew Grace Period at the .com registry. The registrar's own renewal window can be shorter | icann.org/zh/registry-agreements/com/com-registry-agreement-appendix-7-1-12-2012-en (3.1.3) | 12 Oct 2026 |
| 30 days after deletion | Redemption Grace Period: DNS off, transfers blocked, the registrant can restore through the registrar, usually for a restore fee | icann.org/resources/pages/errp-2024-02-21-en (3.1 to 3.3, 4.1) | 12 Oct 2026 |
| Then 5 days (.com) | Pending delete: cannot be restored, then released for anyone to register | icann.org/zh/registry-agreements/com/com-registry-agreement-appendix-7-1-12-2012-en (3.3.2) | 12 Oct 2026 |
TLS certificate maximum validity timeline
| Maximum validity | Domain validation reuse | Status on 12 Oct 2026 | |
|---|---|---|---|
| Issued before 15 Mar 2026 | 398 days | 398 days | No longer issued; the last expire by 16 Apr 2027 |
| Issued 15 Mar 2026 to 14 Mar 2027 | 200 days | 200 days | Applies now |
| Issued 15 Mar 2027 to 14 Mar 2029 | 100 days | 100 days | Next step |
| Issued from 15 Mar 2029 | 47 days | 10 days | Final step |
Domains, certificates and subscriptions, each with an owner
Current and legacy domains in one register, with the account that renews them
A rebrand or acquisition doubles the domain list overnight, and the old names still carry redirects, email and backlinks. Record each domain with its registrar, account login owner, payment card, renewal date and whether it auto-renews. One health-tech IT team we work with tracks about 20 domains across its current and legacy brands this way, alongside its wildcard certificate and SaaS subscriptions.
Registrar, account owner and card on every domain
Legacy and redirect domains kept visible
Auto-renew still gets a check-it-worked reminder
Manual certificates flagged before lifetimes drop to 100 and then 47 days
Since 15 March 2026 a public TLS certificate can last at most 200 days, so a manually renewed certificate needs replacing about twice a year. From 15 March 2027 the limit is 100 days, and from 15 March 2029 it is 47 days, which is roughly eight renewals a year. Automate with ACME wherever you can. ExpiryEdge does not scan certificates; record the ones automation cannot reach so a named person is reminded before each one expires.
Each certificate marked automated or manual
Reminders to the owner for every manual renewal
A check that automated renewals actually ran
Firewall and Wi-Fi licences that stop features when they lapse
Fortinet documents that a FortiGate keeps working as a firewall when FortiGuard licences expire, but signatures stop updating and category-based web and DNS filtering stops, dropping all web and DNS traffic by default. Cisco Meraki co-termination licensing gives a 30-day grace period after the co-term date before the organisation's devices are shut down. Put each subscription on the register with its owner and the vendor's renewal lead time.
Security subscriptions and support contracts per device or organisation
Owner and reseller contact on each record
History of renewals for audits
What stops when network licences lapse
| At expiry | Grace period | Official source | |
|---|---|---|---|
| Fortinet FortiGuard (FortiGate) | Still works as a firewall. Antivirus, IPS and application signatures keep working but stop updating. Category web and DNS filtering stops; by default all web and DNS traffic is dropped | None stated. Fortinet says lapses require coverage back to the contract expiration date | docs.fortinet.com/document/fortigate/8.0.1/administration-guide/289376/license-expiration |
| Cisco Meraki, co-termination licensing | After the grace period all Meraki devices in the organisation are shut down until licensing is back in compliance | 30 days after the co-term date | documentation.meraki.com, Meraki Co-Termination Licensing Overview |
| Cisco Meraki, per-device licensing | Only the device or product whose licence expired is shut down | 30 days | documentation.meraki.com, Meraki Per-Device Licensing Overview |
Do this now: a two-hour domain and certificate audit
| Time (estimate) | What you end up with | |
|---|---|---|
| 1. Export the domain list from every registrar account you know about | 20 minutes | Domain, registrar, expiry date and auto-renew status |
| 2. Look up any domain not in those accounts at lookup.icann.org (RDAP) | 20 minutes | Registrar and expiry date for forgotten or personally registered domains |
| 3. In each registrar account, check the card expiry date and change the contact email to a shared mailbox | 15 minutes | Renewal notices that reach a team, not a former employee |
| 4. Search certificate transparency logs (for example crt.sh) for every domain | 30 minutes | A list of certificates issued for your names, including ones nobody remembers |
| 5. Mark each certificate as automated (ACME) or manual, and note where it is installed | 20 minutes | The short list of certificates that need a human |
| 6. Give every row an owner and a backup, and set reminders at 90, 30 and 7 days | 15 minutes | Nothing on the list without a person attached |
What changes for the IT lead
Current-brand domains on the company registrar account, legacy domains on an agency's account, a wildcard certificate bought by an engineer who has since left, and renewal emails going to a personal inbox. The first sign of a problem is a browser warning or bounced email.
Every domain, certificate and subscription sits on one register with its registrar or vendor, account owner, card and renewal date. Reminders reach the owner at 90, 60, 30 and 7 days in email, Slack or Teams, and anything overdue escalates to the IT manager.
Spreadsheet, monitoring tool or ExpiryEdge for domain expiration?
| ExpiryEdge | Spreadsheet | Certificate monitoring | |
|---|---|---|---|
| Detects certificates on live servers automatically | |||
| Domains, certificates and subscriptions in one register | Manual | Partial | |
| Owner and backup reminded at 90, 60, 30 and 7 days | Alerts only | ||
| Escalation when a date passes | Varies | ||
| Registrar account, card and contact details per domain | Manual | ||
| Timestamped renewal history and export | Varies |
For gTLDs such as .com, the registrar can delete the registration at any time after expiry, and while it is still renewable the registrar must interrupt DNS, so the website and email stop working. After deletion the registry holds the name in a 30-day Redemption Grace Period, when only the previous registrant can restore it through the registrar, usually for a restore fee. Then it is released.
It depends on your registrar and the extension. ICANN policy lets a registrar delete a gTLD registration at any time after expiry, and the .com registry allows up to 45 days of auto-renew grace, but your registrar may delete sooner. After deletion there is a 30-day redemption period at a higher fee. Country-code domains follow their own registry rules. Renew before the expiry date.
A public TLS certificate issued on or after 15 March 2026 can be valid for at most 200 days. The limit drops to 100 days for certificates issued from 15 March 2027 and to 47 days from 15 March 2029, under the CA/Browser Forum Baseline Requirements. Certificates issued before 15 March 2026 could last up to 398 days.
Turn it on for every domain, but do not rely on it alone. Auto-renew fails when the card on file has expired, the account belongs to someone who has left, or renewal emails go to an unread inbox. Keep a reminder on each domain about 30 days before expiry to confirm the renewal went through and the card is current.
List every domain for every brand, including legacy names that still redirect or receive email, with the registrar, account owner, card and expiry date. Consolidate into company-owned registrar accounts where you can. Decide on purpose which legacy domains to keep, and keep renewing those for as long as they carry redirects, email or links.
Fortinet says a FortiGate still works as a firewall when FortiGuard licences expire, but signatures stop updating and category-based web and DNS filtering stops, dropping all web and DNS traffic by default. Cisco Meraki co-termination licensing allows a 30-day grace period after the co-term date, after which the organisation's devices are shut down until licensing is back in compliance.
No. ExpiryEdge does not scan servers or certificates. You enter each expiry date, import a spreadsheet, or send dates in through the API or Zapier, and ExpiryEdge makes sure a named owner is reminded and escalated. Pair it with ACME automation and a certificate monitor for the certificates those tools can see.
Put an owner on every domain and certificate
Import your domains, certificates and subscriptions, send reminders to email, Slack or Teams, escalate when a date passes. Free 14-day trial, no credit card.