Why certificate expiry is a monitoring problem, not a setup problem
You can configure perfect auto-renewal today and still have an outage in 90 days. The renewal process depends on a chain of moving parts — DNS, firewall, the ACME client, the host running it. Any one of those drifting silently breaks renewal long before the cert actually expires. Monitoring closes the loop by checking the live certificate, not the renewal config.
What to monitor on every certificate
- Days until expiry — the single most important field. Alert at 30, 14, and 3 days.
- Chain validity — an intermediate cert can be expired even when the leaf isn't.
- Hostname match — confirms the certificate actually covers the hostname users hit.
- Issuer — a sudden issuer change is a strong signal of a misconfigured renewal or a takeover.
Operational workflow when a cert is about to expire
- Receive the 30-day alert. Open the monitor, confirm the cert in question.
- Trigger renewal manually if your host supports it; verify it succeeded with a fresh check.
- If renewal failed, walk the chain: DNS challenge records, HTTP challenge path, firewall rules.
- Once the new cert is live, the monitor's next poll updates the expiry field — no manual confirmation needed.
- Log the incident so next quarter's renewal isn't a surprise.
Building a multi-domain SSL monitoring portfolio
One certificate is easy; twenty across customer subdomains, marketing sites, and APIs is where teams lose track. Saving each hostname as its own monitor gives you a single dashboard view of expiry dates, sorted by urgency. The cost of monitoring is trivial; the cost of a single browser-warning outage on a checkout page is not.