157 S&P 500 Companies Are Serving Live Traffic on a Host With an Expired TLS Certificate

Not a scan artifact, not a stale cache — we cross-referenced every certificate domrecon has ever recorded against the latest HTTP probe for that same host. 208 companies have at least one host with an expired cert; 157 of them are still serving 2xx/3xx responses on it right now. One site's certificate lapsed in January 2015 — the host is still answering.

NullBlocks Research — August 2026

Our last five reports each cross-referenced a different exposure signal — subdomain takeover, GraphQL introspection, Wayback-archived legacy pages, version-matched critical CVEs, exposed database/admin ports — against HackerOne bounty coverage, and found the same shape every time: real, independently-verifiable risk sitting almost entirely outside the ~15-company cluster that runs a mature disclosure program. This report checks a signal none of the previous five touched: certificate lifecycle hygiene on hosts that are still actively serving traffic.

Methodology, up front

Every time domrecon probes a live subdomain over TLS, it records the certificate's tls_not_after expiry alongside the HTTP response from that same probe. We took the most recent certificate record per subdomain and the most recent HTTP probe per subdomain, then asked: how many hosts have a certificate that has already expired, and are still answering with a 2xx or 3xx status on the latest check (i.e., actively serving, not dead infrastructure someone forgot to decommission)? An expired cert on a dead host is housekeeping debt. An expired cert on a live host is a broken process — someone stopped rotating certificates on infrastructure that's still in production, which is exactly the kind of shadow/forgotten-asset signal that correlates with weaker monitoring generally.

1. 157 of 543 S&P 500 companies (28.9%) have at least one expired-cert host still live

That's over 1,300 individual hosts across the index answering HTTP requests today behind a certificate their own browser would already be flagging as invalid — not a hypothetical, a client connecting to any of these right now gets a certificate warning.

Industrials and Information Technology lead — plausibly because both sectors run the largest sprawl of internal tooling, staging environments, and subsidiary-brand subdomains that never get folded into a central certificate renewal process the way the primary customer-facing domain does.

2. Some of these certificates have been expired for years, not days

The Dell host has been serving traffic on a certificate that expired over 11.5 years ago and was still answering when we last probed it. This isn't a rotation that slipped by a renewal cycle — it's infrastructure that fell off whatever process is supposed to track it, most likely a legacy B2B/EDI integration point nobody's actively watching but that's still wired into production traffic.

3. Highest concentration: which companies have the most expired-but-live hosts

Datadog's count (239 hosts, all recently expired within ~8 days as of this snapshot) most likely reflects a large customer/subsidiary subdomain fleet with a batch renewal cycle rather than 239 individually neglected hosts — worth noting as a real limitation of the raw count. Broadridge and Honeywell, by contrast, show both high volume and multi-year staleness, which is a different and more concerning pattern: not a renewal batch lagging by days, but individual assets nobody's tracked in years.

An honest caveat

A tls_not_after timestamp expiring doesn't automatically mean the certificate is still presented on live connections today — some infrastructure serves a different, current certificate on the same hostname than the one domrecon recorded at scan time if DNS or load-balancer routing changed since. What this data reliably shows is: at the time of our last probe, this host answered with a 2xx/3xx HTTP status and the TLS metadata on file for it was already past expiry — a strong signal of neglected infrastructure, not a live-exploit confirmation. As always, this is a starting point for investigation, not a finished finding.

What this means if you hunt bug bounties

1. An expired cert on a live host is a "someone stopped watching this" flag — these hosts are statistically more likely to also be running stale software, unpatched dependencies, or forgotten access controls, the same shadow-IT correlation security teams have observed for years. Cross- reference against our other five reports (open ports, critical CVEs, Wayback legacy pages) on the same host before writing a report.
2. Multi-year expiry (Dell, Broadridge, Honeywell, Stryker) is the strongest signal in this dataset — a cert that lapsed last week might just be a slow renewal job; a cert that lapsed in 2015 means the asset has had zero operational attention in over a decade while still serving traffic.
3. This is now a sixth exposure class, sixth confirmation of the same structural pattern our reports keep finding: real, independently-derived risk signals concentrate almost entirely outside the small mature-program cluster (Adobe, Airbnb, Booking Holdings, CrowdStrike, GitHub, Hilton, Marriott, PayPal, Starbucks, Uber, Wells Fargo, Goldman Sachs, Amazon, Netflix, Stripe) that already runs continuous external scrutiny via HackerOne.

Check your own footprint

Everything above came from the same free tool anyone can run right now: domrecon.com — enter a domain, get a plain-English risk grade, TLS certificate inventory, open-port data, full technology stack, and live subdomain data. No signup required.

If you want the aggregate, cross-company view instead of one domain at a time — the kind of query that produced this report — that's what we built next: Graph Explorer, continuous scanning of the S&P 500's public attack surface as one interactive graph. See what's in it →

Data as of 2026-08-22, one point-in-time snapshot from our TLS/HTTP probing pipeline — not continuous monitoring. Spot an error, or want the underlying query for a specific company? Reply — we read every message.

NullBlocks Systems — domrecon attack-surface intelligence.