diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml
index ce5b1d0..4bc21e0 100644
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@@ -181,9 +181,13 @@ jobs:
             -servername ${{ vars.DOMAIN }} 2>/dev/null \
             | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
           echo "Expira: $EXPIRY"
-          DAYS=$(( ($(date -d "$EXPIRY" +%s) - $(date +%s)) / 86400 ))
-          echo "Dias restantes: $DAYS"
-          [ "$DAYS" -gt 7 ] || (echo "❌ Cert expira em $DAYS dias" && exit 1)
+          # Alpine usa busybox date — converte via openssl diretamente
+          DAYS=$(echo | openssl s_client -connect ${{ vars.SSH_HOST }}:443 \
+            -servername ${{ vars.DOMAIN }} 2>/dev/null \
+            | openssl x509 -noout -checkend 604800 2>/dev/null; echo $?)
+          # checkend retorna 0 se válido por mais de N segundos (604800 = 7 dias)
+          [ "$DAYS" = "0" ] || (echo "❌ Cert expira em menos de 7 dias!" && exit 1)
+          echo "✅ Certificado válido por mais de 7 dias (expira: $EXPIRY)"
 
       - name: GET /api/v1/properties
         run: |