As I can see some sites were working yesterday and today they are not working so my guess is browsers have a grace period set in them. certificate lifespans limited to 1 year in browsers.
Maybe this is based on the Certificate Authority. TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error)
Where is the best place to check for this? Will the canary build handle this check for me so we can see the failure early on? What is the best way to handle spread out certificates in a centralised location?