I have a website on Squarespace and the TLS certificate is set to expire in less than 24 hours.

        Issuer: C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3
            Not Before: Aug 10 18:38:10 2019 GMT
            Not After : Nov  8 18:38:10 2019 GMT

I understand that certificates from Lets Encrypt are limited to a 90 day lifetime, and that certificates are typically renewed around 60-80 days after being issued. Using certificate transparency logs I can see that Squarespace has indeed renewed the certificate, but the new certificate isn't being served by their webservers yet. I reached out to Squarespace support and got this concerning non-answer, so I'm looking to better understand the situation now.

So long as your domain is active and connected to your Squarespace website using our recommended CNAME and A records (which you are), your SSL certificate will remain valid and you do not need to worry about expiration. Your SSL certificate refreshes every 90 days.

When does Squarespace usually renew certificates, and when do they begin serving them on their webserver?


Update: My experience was weird and defied all expectations.

I was checking the certificate that was being served right up until about 10 seconds before the expiration date, using a variety of applications and devices (curl, Firefox, Safari, Chrome, an iOS app). All of them indicated that certificate expiry was imminent.

But when I checked again, the connection was still negotiated OK, and a new certificate with a new expiration date was being served. It appeared as if Squarespace had rotated the certificate being served within the last 10 seconds before it expired. This aligns with what I was told by support, but I have to say I'm very surprised at this outcome. This anecdote appears to invalidate the rest of my answer.

Squarespace appears to start serving renewed certificates after 60 days, right at the beginning of the renewal window provided by Lets Encrypt.

I used Robtex to identify a variety of website domain names that are all hosted on Squarespace (by correlating the same IP addresses used to host my website). From these sites, I gathered the dates that certificates were minted and set to expire. All of the certificates in the sample ranged from 0 to 59 days old. None had fewer than 30 days until expiry. From this I can deduce that Squarespace serves renewed certificates at the 60 day mark.

Additionally, using the certificate transparency logs provided by crt.sh, it's clear to see that Squarespace has a consistent pattern of requesting issuance of new certificates 30 days before the expiry deadline.

  • Certificates can be renewed in advance and started to be used only when really necessary, this would really be a local policy (so besides the provider itself I guess no one can really reply to you). This depends a lot on the technical infrastructure used, and if certificates are loaded by the webserver/load balancer upfront (at start/reload; which is often the case for simple situations) or dynamically retrieved in some way only when the TLS connection starts. Also note that there is TLS mechanisms to restart previous connections without renegotiating everything. Dec 3 '19 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.