SSL Certificate Monitoring: Never Miss a Renewal Again

SSL certificate monitoring checks the certificate your website actually serves and warns you well before it expires. When a certificate lapses, browsers replace your site with a full-page warning such as “Your connection is not private”, and most visitors leave. Monitoring makes sure you hear about an upcoming expiry weeks ahead, while it is still a calendar task and not an outage.

Why certificates still expire

Certificates have short lifetimes, and many are issued for 90 days and renewed automatically. That makes expiry rarer, not impossible. Renewal depends on several things working at the same time, and any of them can break quietly:

• Validation fails. The certificate authority must verify that you control the domain, often through an HTTP request to the server or a DNS record. A firewall rule, a redirect or a DNS change can block it.
• The renewal job stops. The task that renews certificates is a scheduled job like any other. If the server is rebuilt or the job is removed, nothing renews.
• The new certificate is not loaded. Renewal succeeds, but the web server keeps serving the old certificate until it is reloaded.
• Servers drift. Behind a load balancer, one server can serve an older certificate than the rest.
• Manual certificates are forgotten. Purchased certificates that last a year are renewed by a person, and people change roles.

Monitoring looks at the result from the outside: the certificate a visitor receives. That catches all of these cases.

What to monitor

List every hostname that serves HTTPS, not only the main website:

• The main domain and the www variant.
• Shop, checkout and login subdomains.
• API hostnames used by apps and integrations.
• Mail servers using TLS.
• Status pages, help centres and marketing landing pages.
• Old domains that only redirect. The redirect needs a valid certificate too.

Forgotten hostnames are the usual source of surprise warnings.

Choosing reminder windows

The first reminder should arrive early enough to fix a failed renewal or to buy and install a new certificate without rush:

• Automatically renewed certificates: a first reminder about two weeks before expiry. If the certificate has not been renewed by then, renewal has failed and you still have time to fix it.
• Purchased certificates: start 30 days or more ahead, to leave time for approval, validation and installation.

Follow up with reminders closer to the date, and send the final ones to a shared channel rather than one person’s inbox. SSL monitoring in Uptimecheck sends reminders before expiry, so nobody has to remember the date.

Who should get the reminders

Certificate reminders often go to the person who set up the certificate years ago. When that person changes roles or leaves, the reminders go nowhere. Avoid that:

• Send reminders to a shared mailbox or a team chat channel instead of a personal address.
• Name an owner for each certificate in your documentation, together with where it is renewed and installed.
• Agencies should decide per client who renews: the agency, the client or the hosting provider. Write it down, and monitor either way.

Certificates in less obvious places

Some certificates hide outside the web server you think about first:

• CDNs and load balancers terminate HTTPS themselves and need their own certificate.
• Mail servers use certificates for encrypted SMTP and IMAP.
• Internal tools such as admin panels and staging sites often use separate certificates that nobody renews.
• Customer domains: if your product lets customers use their own domain, each one has a certificate that can fail.

Add them to your inventory as you find them. A short list that is complete beats a long list with gaps.

Domains expire too

A valid certificate does not help if the domain itself expires. Domain renewals are usually yearly or longer, which makes them even easier to forget. Monitor domain expiry next to SSL. See domain monitoring.

Making sure HTTPS keeps working

Expiry is the most common certificate problem, but not the only one. Pair certificate monitoring with HTTPS uptime checks, so you also learn about:

• A certificate that does not cover the hostname, for example after adding a new subdomain.
• An incomplete chain that some browsers and API clients reject.
• A server that suddenly serves a self-signed or default certificate after a configuration change.

An uptime monitor on the HTTPS URL reports an error when the request fails, which surfaces problems like these as soon as visitors would see them.

When a certificate does expire

If a certificate has already expired:

1. Renew or reissue it with your certificate authority or ACME client.
2. Install it on every server that serves the hostname, including load balancers and CDN configurations.
3. Reload the web server so the new certificate is used.
4. Verify from outside with an HTTPS check, not just from the server itself.
5. Find the cause. Fix the renewal job, the validation path or the forgotten reminder, so it does not happen again.

Keep customers informed while you fix it. A status page tells them you know about the problem.

SSL monitoring checklist

1. Inventory every hostname that serves HTTPS, including APIs, mail and redirect-only domains.
2. Add each hostname to SSL monitoring.
3. Set the first reminder at least two weeks ahead for auto-renewed certificates and 30 days for purchased ones.
4. Send reminders to a shared channel.
5. Monitor domain expiry for the same domains.
6. Add HTTPS uptime checks to catch hostname and chain errors.
7. Check the renewal job itself with a heartbeat.
8. Review the list when you add subdomains or change servers.

Summary

Auto-renewal makes expired certificates rarer, not impossible. Monitor what visitors actually receive, start reminders early and keep domains and renewal jobs under watch as well.

SSL and domain monitoring are included on every Uptimecheck plan. Try it free for 14 days, no credit card required.