Check · Transport security · default severity high
Certificate expiry
What Kavach checks
How long until the TLS certificate expires.
Why it matters
An expired certificate takes your whole site offline with a full-page browser warning -- a self-inflicted outage that erodes trust.
How an attacker uses it
- The cert quietly expires on a weekend.
- Every visitor hits a full-page 'Your connection is not private'.
- Users bounce, or worse, learn to click through the warning.
How to fix it
Automate renewal (certbot / your host's auto-renew) so certs renew well before expiry; alert at 30 days left.
Stack-specific fixes: nginx · Apache · Caddy · Express / Node · Cloudflare
Limitations
This is a read-only observation of publicly reachable configuration at scan time. It can produce false positives/negatives (caching layers, geo-specific responses, bot defences) and does not test application logic or authenticated areas. Rule version 1.