Safety
Certificate Expiry vs HSTS for Public Website TLS
June 20, 2022
Certificate expiry vs HSTS is not a pick-one control. A trusted, unexpired certificate is what makes this HTTPS visit work. HTTP Strict-Transport-Security is what tells browsers to skip HTTP next time. An expired or untrusted cert strands users even if HSTS is perfect. HSTS without a working cert turns a miss into a hard fail for every returning browser. Marketing sites need automated renewal, a long-enough HSTS max-age only after HTTPS is stable, and a redirect for first-time clients. RoastMyOpsec's free TLS check confirms the audited URL lands on HTTPS and that the runtime trust store accepts the cert. It is not a cipher-suite audit and it does not watch expiry for you.
The practical difference
The certificate is a present-tense proof. Browsers and the RoastMyOpsec runtime either trust it now or they do not. Expiry, wrong hostname, and incomplete chains fail the handshake. Let's Encrypt and commercial CAs both expire; automation is the control, not the brand of the issuer.
HSTS is a future-tense memory. After a successful HTTPS response with Strict-Transport-Security, supporting browsers refuse cleartext to that host for max-age. includeSubDomains and preload raise the cost of a later rollback. They do not keep the cert alive.
How to choose based on how ready TLS is
If renewal is still manual or a staging host shares the production name, keep HSTS max-age short or off until issuance is boring. If ACME, the CDN, and www plus apex all renew on schedule, raise max-age and keep the HTTP-to-HTTPS redirect for clients that have never seen the header.
Do not preload HSTS while any included subdomain still has a brittle cert. Preload plus an expired leaf is how you lock customers out of the brand until the CA and the preload list both forgive you.
| Control | What it proves | What it does not prove | Takeaway |
|---|---|---|---|
| Valid certificate now | This handshake is trusted by the client | Next month's renewal; HSTS memory | Required every minute the site is live |
| HSTS max-age | Later visits skip HTTP for browsers that cached it | That the next cert will issue on time | Turn on only after renewal is automated |
| HSTS preload | First visit HTTPS for browsers on the list | Operational recovery if TLS breaks | Last step, after every subdomain is ready |
| HTTPS redirect | This request's cleartext URL | Certificate health; mixed content | Keep it even after HSTS |
When a valid cert still fails OPSEC
A green padlock on the homepage does not fix mixed content, HTTP campaign links, or a sibling subdomain that still serves HTTP. It also does not mean you monitor expiry. Teams that 'checked TLS once at launch' are the ones who discover Not After in the incident channel.
The free RoastMyOpsec TLS finding is scheme and trust at scan time. Pair it with your registrar, CDN, and ACME dashboards. The scan will not page you at 2 a.m. when the leaf dies.
Common mistakes
The first mistake is turning on a two-year HSTS max-age before certificate renewal is automatic.
The second mistake is monitoring only the apex while www, the API host, and the CDN custom hostname expire on different calendars.
The third mistake is treating RoastMyOpsec's TLS-ok result as a substitute for expiry alerting.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is a valid TLS certificate enough without HSTS?
- It is enough for this visit if the client already used HTTPS. Without HSTS (and a redirect), first hops and old http:// links still speak cleartext. You want the cert, the redirect, and HSTS once HTTPS is stable.
- Does RoastMyOpsec check when my certificate expires?
- No. The free TLS check confirms HTTPS and that the runtime trust store accepts the certificate. Watch Not After in your CA, CDN, or ACME tooling.
- Should I disable HSTS if a cert might lapse?
- Fix renewal first. Turning HSTS off does not make expiry safe; it only restores a cleartext first hop. If you must roll back HTTPS, drop max-age carefully and understand preload removal is slow.