What it is
A TLS certificate near expiry with no automated renewal path in place is an outage waiting to happen. When the certificate expires, browsers surface a full-page warning and refuse to load the site by default, mail servers fail to negotiate TLS for STARTTLS on port 25, and API integrations break.
Why it matters
Directly, they don't need to. Indirectly, an expired certificate creates the exact user-training condition attackers benefit from: users learn to click through browser warnings, which primes them to click through the warnings that actually protect against phishing sites and man-in-the-middle attacks.
The check behind the finding
echo | openssl s_client -connect yourfirm.ca:443 2>/dev/null | openssl x509 -noout -enddateShows the date the certificate expires.
Closing it
This can be closed before the certificate lapses, and set up so that it does not come round again. The assessment gives the dates read from outside and the exact steps.