letsencrypt.org:443
Ready for 47-day certificates: renewal looks automated

certificate  letsencrypt.org, issued by YE2 (Let's Encrypt)
lifetime     90 days (2026-09-04 to 2026-12-03), 43 left
renewal      probably automated
ari window   2026-11-02T17:18:36Z to 2026-11-04T12:29:25Z (ahead)

PASS  15 March 2026 (in force)       max 200 days, ~ 3 renewals/yr  Automated renewal absorbs it: about 3 renewals a year, none of them by hand.
PASS  15 March 2027                  max 100 days, ~ 6 renewals/yr  Automated renewal absorbs it: about 6 renewals a year, none of them by hand.
PASS  15 March 2029                  max  47 days, ~12 renewals/yr  Automated renewal absorbs it: about 12 renewals a year, none of them by hand.

PASS  Certificate lifetime: 90 days
      Already within the 100-day limit that applies from 15 March 2027.
PASS  Renewal automation: probably automated
      A 90-day certificate from Let's Encrypt. Nobody renews certificates this short by hand for long, so a client is almost certainly doing it.
PASS  Renewal timing: 43 of 90 days left
      No renewal is due yet.
PASS  ARI renewal window: 2026-11-02 to 2026-11-04
      Let's Encrypt publishes when it wants this certificate renewed, and an ARI-aware ACME client follows it. That is how a CA gets millions of certificates replaced in hours when it has to revoke them.
PASS  Edges: 2 addresses, one certificate
      Every address the name resolves to serves the same certificate, so the last renewal reached all of them.

# every address for letsencrypt.org
35.157.26.135:443                        2026-09-04 to 2026-12-03  Let's Encrypt          1FC4F697EEFA3022  <- this report
63.176.8.218:443                         2026-09-04 to 2026-12-03  Let's Encrypt          1FC4F697EEFA3022  <- this report
[2a05:d014:58f:6200::258]:443            not checked: this server has no IPv6 route
[2a05:d014:58f:6200::259]:443            not checked: this server has no IPv6 route

reproduce: for ip in $(dig +short letsencrypt.org A letsencrypt.org AAAA); do echo "$ip $(echo | openssl s_client -connect "[$ip]:443" -servername letsencrypt.org 2>/dev/null | openssl x509 -noout -enddate)"; done