You already ran the check. WHOIS Lookup told you a domain renews in three weeks, or SSL Checker showed you a certificate that expires next Tuesday. The technical part is done — now you have to tell a client who doesn't think about any of this, without sounding like you're manufacturing a problem to sell them something.
This is the part most technical guides skip, and it's the part that actually determines whether the client trusts you or starts wondering if you're padding the invoice. Here's how to say it.
First, figure out which kind of problem you actually have
Not every expiry finding deserves the same tone, and conflating them is the single most common mistake. There are really only two categories:
- It's broken right now. The certificate has already expired, the domain has already lapsed, visitors are seeing a browser warning or the site is down. This needs same-day communication and a clear next step, because the client is either already getting complaints or about to.
- This will be a problem in a few weeks if nobody acts. The domain renews in three weeks, the cert expires in ten days, nothing is wrong yet. This deserves a calm, plainly-stated heads-up — not the same urgency as the first case, even though the underlying fact (an expiring domain or certificate) is technically the same category of thing.
Sending a "your website is broken" tone for a problem that's still three weeks out reads as alarmist, and it trains the client to tune out your next message. Sending a casual, buried-in-an-email tone for something that's already broken reads as careless. Match the tone to which one you're actually looking at.
Language for "this is broken right now"
Be direct, be fast, and lead with what the client will actually notice — not the technical cause.
"Heads up — your SSL certificate expired this morning, so visitors to [site] are currently seeing a security warning in their browser. I can get a new certificate issued today; it usually takes under an hour once I have the go-ahead."
Notice what this does: states the impact first (visitors see a warning), states that it's fixable and roughly how long that takes, and asks for permission to proceed rather than assuming it. That last part matters — even in an active-outage message, don't skip consent to make a change, unless you already have standing authorization for exactly this kind of fix.
Language for "this will be a problem in a few weeks"
This is the more common case, and the one people get wrong most often — either by underselling it into an email nobody reads, or overselling it into something that sounds like a scare tactic.
"While I was checking on [site] today, I noticed the domain is set to expire on [date] — about three weeks out. Nothing's wrong right now, but if it lapses before renewal, the site and any email tied to it would go down until it's renewed and re-pointed, which usually takes longer to sort out than the renewal itself would have. Worth getting ahead of — can you confirm who currently handles the renewal, or would you like me to look into it?"
This works because it: states the fact plainly, explicitly says nothing is currently wrong (this is the sentence that keeps it from sounding alarmist), explains the actual consequence of doing nothing in concrete terms, and ends with a specific, low-pressure question rather than a vague "let me know."
Phrases that undercut you either way
A few patterns to avoid regardless of which category you're in:
- Leading with jargon. "Your TLS certificate's validity period has elapsed" is accurate and useless. Say what a visitor would actually see.
- Hedging past the point of clarity. "This might potentially become an issue at some point" is so soft it doesn't register as something worth acting on — if it's worth telling them, be plain about why.
- Manufacturing urgency that isn't there. Don't describe a three-week runway as an emergency. Clients remember when a "critical" finding turned out to have three weeks of slack, and it costs you credibility on the next one.
- Burying the finding in a longer status update. A domain expiry notice shouldn't be item six in a bulleted list about unrelated maintenance work — it deserves its own message or its own clearly separated section.
What to send, structurally
Regardless of urgency level, a good finding message has the same three parts in the same order: what you found, what happens if nothing changes, and what you need from them (a decision, a confirmation, or nothing at all if you're just handling it). Skipping the third part is the most common gap — a finding with no ask just creates anxiety with nowhere to go.
If you haven't already run the check that surfaced this, WHOIS Lookup will show you a domain's exact expiration date and current registrar, and SSL Checker will show a certificate's expiration date and trust status — both take seconds and are exactly where this kind of finding starts.
Bookmark this page — it's built to be the reference you pull up any time you need to turn a WHOIS or SSL finding into a message a client actually reads calmly.