What is it?
This TLS finding means the certificate presented by the HTTPS service is valid now but is close to its expiration date. It belongs to SSL/TLS certificate lifecycle monitoring.
Why does it matter?
Expired certificates cause browser warnings, API failures, and service outages. Renewal problems are easiest to fix before the certificate reaches its final days, especially when DNS validation, CDN automation, or intermediate chains are involved.
How to fix it?
Renew the certificate and verify the new certificate is served for the exact hostname.
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates -issuer -subjectCheck automated renewal jobs, ACME DNS or HTTP validation, CDN certificate status, and the full intermediate chain. Rerun the audit after deployment to confirm the new notAfter date.