From c16d6dcf751eb332719867d7e9dea797b8a26c7b Mon Sep 17 00:00:00 2001
From: Walusimbi Silver <107974377+swalusimbi@users.noreply.github.com>
Date: Thu, 3 Sep 2026 14:32:02 +0300
Subject: [PATCH] Raise expiry threshold above certbot's renewal window

Certbot renews at 30 days remaining, so a healthy certificate never falls
below it and the old 14 day threshold could only fire after renewal had
been broken for 16 straight days, leaving 14 days to react. 25 days fires
about five days after the first failed renewal.
---
 README.md                    | 12 +++++++++---
 scripts/check-cert-expiry.sh |  2 +-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index f381489..838aeee 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,13 @@ maintenance checks can be added here over time.
 
 `scripts/check-cert-expiry.sh` checks every Let's Encrypt certificate under
 `/etc/letsencrypt/live` and sends an ntfy alert when any certificate expires in
-less than 14 days.
+less than 25 days.
+
+The threshold sits just below certbot's own renewal window. Certbot renews at 30
+days remaining, so a healthy certificate never drops below that. A 25 day
+threshold fires roughly five days after renewal first fails and still leaves 25
+days to fix it. A threshold below the renewal window means renewal has to stay
+broken for weeks before the alert trips, which is too late to be useful.
 
 ### Install
 
@@ -32,7 +38,7 @@ sudo install -m 0755 scripts/check-cert-expiry.sh /opt/scripts/check-cert-expiry
 
 ```bash
 CERT_DIR=/etc/letsencrypt/live
-EXPIRY_DAYS=14
+EXPIRY_DAYS=25
 NTFY_URL=http://127.0.0.1:2586/certbot
 ALERT_ON_NO_CERTS=true
 ```
@@ -40,7 +46,7 @@ ALERT_ON_NO_CERTS=true
 ### Overrides
 
 ```bash
-EXPIRY_DAYS=21 /opt/scripts/check-cert-expiry.sh
+EXPIRY_DAYS=40 /opt/scripts/check-cert-expiry.sh
 ```
 
 If the ntfy topic is protected with an access token:
diff --git a/scripts/check-cert-expiry.sh b/scripts/check-cert-expiry.sh
index cb0751a..9a6400c 100644
--- a/scripts/check-cert-expiry.sh
+++ b/scripts/check-cert-expiry.sh
@@ -3,7 +3,7 @@
 set -uo pipefail
 
 CERT_DIR="${CERT_DIR:-/etc/letsencrypt/live}"
-EXPIRY_DAYS="${EXPIRY_DAYS:-14}"
+EXPIRY_DAYS="${EXPIRY_DAYS:-25}"
 NTFY_URL="${NTFY_URL:-http://127.0.0.1:2586/certbot}"
 NTFY_TITLE="${NTFY_TITLE:-SSL certificate warning}"
 NTFY_PRIORITY="${NTFY_PRIORITY:-high}"