SSL Monitoring

How To Monitor SSL Expiration Before Downtime Happens

Expired SSL certificates are one of the most preventable causes of downtime — and one of the most common. The right monitoring workflow turns expiry from a surprise into a scheduled task with multiple safety nets.

Why expiry slips through

Most teams rely on a single signal: the renewal job in their hosting provider. When that job silently fails — DNS change, ACME misconfiguration, expired API token — there is no second source of truth. An independent monitor is the only way to catch renewal failures before users do.

An operational SSL workflow

Inventory. Every hostname serving HTTPS — production, staging, subdomains, internal portals.
Scheduled checks. Twice-daily expiry and chain validation per hostname.
Tiered alerts. 30 / 14 / 3 day windows escalate to the right people, not the same inbox each time.
Chain validation. Catch intermediate-cert problems separately from leaf expiry.
Post-renewal verification. Confirm the new cert is live, not just that the renewal job exited cleanly.

Continuity beyond the alert

Alerting is only half the workflow. The other half is what happens when one fires: who owns it, where the runbook lives, and how the investigation is recorded. Saving the SSL diagnostic to your operational dashboard turns a recurring stress event into a repeatable, auditable process.

Recommended next steps

Diagnostic workflow

1
Run a manual SSL check
Confirm the current cert, chain, and expiry for any hostname.
Check now
2
Add the hostname to monitors
Schedule expiry and handshake checks with tiered alerting.
Configure monitor
3
Read the SSL expiration monitoring guide
Deep dive into thresholds, escalation, and renewal verification.
Read the guide
4
Continue your operational workflow
Resume any in-progress diagnostics from the dashboard.
Open dashboard

Frequently asked questions

How early should I be alerted before SSL expiry?

30, 14, and 3 days is the standard escalation: 30 gives you buffer for vendor delays, 14 is action time, 3 is emergency.

Why do certs still expire even with auto-renewal?

Auto-renewal silently breaks when DNS changes, ACME challenges fail, or the renewing host loses permissions. A separate monitor is the only honest verification.

Should I monitor intermediate certificates too?

Yes. Many outages come from an expired or misconfigured intermediate, not the leaf cert. Chain validation is part of a complete SSL monitor.

How often should SSL checks run?

Once or twice per day is plenty for expiry; continuous handshake checks are better handled by the uptime monitor.

Do I need to monitor every subdomain?

Every subdomain that serves HTTPS to users or internal systems, yes. Wildcard certs simplify renewal but still need to be observed.