The attacker's certificate for Virtualizor's domains was real, correctly chained, and issued by Let's Encrypt. That's the actual story: certificate validity checks the cert, not the network path serving it.
Chrome 154 turns on HTTPS-by-default warnings for everyone in October 2026. Finding your subdomains is the easy part. Knowing which of them actually need fixing before then is the part nobody's writing about.
Let's Encrypt shut down OCSP entirely in August 2025. Chrome and Firefox both moved revocation checking off the live connection years ago. Most OCSP stapling tutorials still teach it as the default, without saying any of that.
Let's Encrypt's shift to 45-day certificates will double daily renewal requests. Here is which rate limit you actually hit, why, how long until it resets, and the one mechanism most automated setups already have that sidesteps the problem entirely.
Most SSL monitoring dashboards show a green check for two things: the TLS handshake succeeded and the certificate has not expired. Neither one confirms the chain is complete, and an incomplete chain fails silently for exactly the clients your monitor never tests.
ACME Renewal Information (RFC 9773) lets a CA tell your client to renew earlier than the raw expiry date suggests. Every guide treats it as an ACME-client feature. None treats it as a second signal an external monitor could watch.
Building a certificate inventory from scratch is unnecessary work. Certificate Transparency logs already record every certificate issued for your domain, in public, for free. Here is how to read that record yourself.
Let's Encrypt ended its certificate expiration emails in June 2025. Here is why its own recommended fix does not solve the real problem, and what actually catches a renewal that fails silently.
Checking an SSL certificate's expiration takes ten seconds with a browser or openssl. The real problem: certificate lifespans have already dropped to 200 days and reach 47 by 2029, so a once-a-year manual check no longer protects you. Here is how to check, and how to automate it.