SSL certificate monitoring made easy

A securely encrypted website is no longer optional. Browsers flag every page without valid HTTPS, search engines prefer encrypted sites, and payment providers require it. Yet expired and misconfigured certificates still take well-run websites offline every week, usually because a renewal silently failed and nobody noticed until visitors saw a full-page security warning. This guide explains what SSL monitoring is, which SSL certificate errors it catches, how expiry notifications should be timed, and how to set up SSL certificate monitoring yourself with standard tools.

What is SSL monitoring?

SSL monitoring is the continuous checking of the SSL/TLS certificates that protect your websites, APIs, mail servers and other services. “SSL” is the historical name; modern servers speak TLS, but the certificates and the term SSL certificate monitoring have stuck. The goal is simple: know about every certificate problem before a visitor, a customer or a browser does.

A certificate is valid only for a fixed period, for specific hostnames and only when it chains up to a root that browsers trust. Any of those conditions can break – the date passes, a new subdomain goes live without coverage, an intermediate certificate goes missing after a server migration. SSL monitoring watches each condition on a schedule and alerts you when one fails or is about to fail. That turns certificate management from a calendar reminder somebody forgets into an automatic early-warning system.

Why certificates still expire in the age of auto-renewal

Free certificate authorities and the ACME protocol made renewal automatic for most websites, which is a huge improvement. But automation moves the failure point rather than removing it. A renewal job depends on a working challenge – an HTTP file the CA can fetch or a DNS record it can read – and on a server that reloads the new certificate. Change the DNS provider, add a redirect, move the site behind a CDN or firewall, rotate an API token, and the challenge can start failing without anyone noticing.

Because the old certificate keeps working until its end date, a broken renewal is invisible for weeks. The logs fill with errors nobody reads, and the first real symptom is the browser warning on expiry day. Certificate lifetimes are also getting shorter: under the CA/Browser Forum schedule, the maximum validity of public certificates is being reduced step by step from 398 days towards 47 days by 2029. Shorter lifetimes mean more renewals per year, and every renewal is another chance to fail. That is exactly why SSL monitoring matters more today than when certificates lasted years.

What an SSL monitoring tool does

An SSL monitoring tool connects to each endpoint the way a browser does, receives the certificate the server presents and evaluates it. It reads the expiry date and calculates the days left, compares the hostname you requested with the subject and Subject Alternative Names, rebuilds the chain from the leaf certificate through any intermediates to a trusted root, and notes the protocol version and cipher the server negotiated. More thorough tools also check revocation status and the key size or signature algorithm.

subject   CN=www.myshop.com
SAN       www.myshop.com, myshop.com
issuer    intermediate CA → trusted root
notAfter  in 11 days
protocol  TLS 1.3
hostname  shop.myshop.com not covered

The tool then compares the results with rules – for example “warn when fewer than 30 days remain” or “alert immediately if the chain is incomplete” – and sends notifications when a rule is broken. Good tools display the certificate details next to the other health data of the service, keep a history so you can see when a certificate changed, and repeat the check often enough that a newly introduced error is caught within minutes or hours rather than days.

• Validity period: not yet valid, valid, expiring soon or expired
• Hostname match against the subject and the SAN list, including wildcards
• Chain of trust: leaf, intermediates and a root the client trusts
• Protocol and cipher: TLS 1.2 or 1.3, no outdated SSLv3 or TLS 1.0
• Revocation, key length and signature algorithm on stricter setups

Common SSL certificate errors and their causes

Most SSL certificate errors fall into a handful of categories, and each has a typical cause. Knowing them makes alerts actionable: the error message usually tells you where to look. The table lists the errors visitors and monitoring tools see most often, with the usual cause and the fix.

Mixed content deserves a special mention because a certificate check alone does not catch it. The certificate is fine, but the page loads images, scripts or stylesheets over plain HTTP. Browsers block the insecure scripts and mark the page as not fully secure. It typically appears after a migration to HTTPS when old absolute URLs remain in the database or theme, and it is found by scanning the page source for http:// resources rather than by inspecting the certificate.

Get notified about an upcoming SSL certificate expiry

Expiry is the most predictable certificate failure, which makes it the easiest to prevent. The trick is timing the notifications. A single warning one day before expiry is too late if the renewal problem needs a DNS change, a purchase order or a colleague on holiday. A warning only at 60 days is easy to postpone and forget. A staged schedule solves both: the widely used rhythm of 30, 14, 7 and 1 day before expiry gives a month of lead time and repeats the message as the deadline approaches.

With automated renewal, the first notice is the most valuable one. Most ACME clients renew when about a third of the lifetime remains, so a certificate that still shows fewer than 30 days left means the automation has already failed at least once. Treat that first warning as a bug report for the renewal job, not as a reminder to renew by hand. For certificates bought manually from a commercial CA, the 30-day notice is the trigger to start the order and validation process, which can take days for organisation-validated certificates.

How to set up SSL monitoring

Setting up SSL monitoring takes less time than recovering from a single expired certificate. Start with an inventory: list every hostname that serves TLS – the main domain and www, shops, API endpoints, customer portals, mail servers, staging systems that partners use. Certificate Transparency logs help here, because every publicly trusted certificate issued for your domain is logged; searching them often reveals forgotten subdomains with their own certificates.

Next, choose how each endpoint is checked. Every hostname needs its own check, because one server can present different certificates depending on the name requested (SNI). Define the rules – expiry thresholds, chain validation, hostname match – and decide who receives the notifications. Finally, run the checks on a regular schedule: daily is enough for expiry, while errors introduced by a deployment are best caught by checks that run several times an hour. Remember to add new hostnames to the list whenever a service goes live, otherwise the inventory decays.

• List every TLS hostname and port, including non-web services
• Search Certificate Transparency logs for forgotten subdomains
• Create one check per hostname so SNI is tested correctly
• Set expiry thresholds (30/14/7/1 days) and instant error alerts
• Assign an owner for each certificate and a fallback contact

Check an SSL certificate by hand

Before automating, it helps to know how to check a certificate manually – it is also the fastest way to confirm an alert. The openssl command-line tool connects to a server, shows the delivered certificate and prints its subject, issuer and validity dates. Passing -servername ensures SNI is used, so you see the certificate for the hostname you care about rather than the server default.

$ openssl s_client -connect www.myshop.com:443 -servername www.myshop.com </dev/null 2>/dev/null \
    | openssl x509 -noout -subject -issuer -enddate
subject=CN = www.myshop.com
notAfter=Oct 27 09:12:44 2026 GMT
$ … | openssl x509 -noout -checkend 1209600 || echo "expires within 14 days"
expires within 14 days

The -checkend option takes a number of seconds and returns a non-zero exit code if the certificate expires within that time, which makes it ideal for scripts. Adding -showcerts prints the whole chain, so you can see whether the intermediate is present. On the browser side, clicking the padlock shows the same information, and an online SSL checker gives you the result without a terminal. Whatever method you use, check the exact hostname visitors use, and check it from outside your network, because internal load balancers sometimes present different certificates.

Automate SSL monitoring with standard tools

If you prefer to run your own SSL monitoring, the building blocks are well established. The simplest version is a cron job that loops over a list of hostnames, runs openssl with -checkend for 30, 14, 7 and 1 days and emails the result. Classic infrastructure monitors such as Nagios-compatible plugins can check certificate age with a single option, and Prometheus users often rely on the blackbox exporter, whose probe exposes the earliest certificate expiry as a metric you can alert on.

Do not forget the renewal side. ACME clients can send their own failure notices, and many can run hooks after each renewal. Certificate authorities and Certificate Transparency monitoring services can notify you when a new certificate is issued for your domain, which doubles as a security signal: an unexpected certificate may indicate a misissuance or a compromised DNS account. Whatever you build, test the alert path itself – a monitoring script whose emails land in spam protects nothing.

Choose your preferred type of notifications

SSL notifications come in two flavours with different urgency. Expiry reminders are planning information: they belong in a shared mailbox or ticket queue where someone picks them up during working hours. Certificate errors on a live site – expired, mismatched, untrusted – are outages, because browsers block the page, and they deserve the same fast channel as any other downtime alert.

Send each alert to a role rather than a person where you can. Certificates often outlive the job of whoever set them up, and reminders sent to a departed colleague are a common reason certificates expire. Include the hostname, the days left and the issuer in the message, so the recipient can act without opening another tool. Repeating the notification at defined intervals – recurring notifications – keeps a problem visible until it is fixed rather than relying on a single message being read.

How to prevent your SSL certificate from expiring

Prevention rests on three habits. First, automate renewal wherever possible, using ACME with your CA or the auto-renewal feature of your hosting provider or certificate authority. Second, keep an organised record of every certificate: hostname, issuer, issuance and expiry dates, renewal method and owner. Third, monitor the outcome independently of the renewal mechanism, because the system that renews a certificate is not a reliable witness to its own failures.

Run a short audit every quarter: compare the inventory with Certificate Transparency logs, remove certificates for retired hostnames, and confirm that renewal works by checking the issue dates of recently renewed certificates. When you change DNS providers, CDNs or firewalls, test the renewal challenge immediately rather than waiting for the next scheduled renewal. And understand the renewal process specific to your provider – manual validation steps for commercial certificates take time that a last-minute reminder does not leave.

• Automate renewal via ACME or the provider’s auto-renew
• Keep a certificate inventory with owners and dates
• Monitor expiry independently of the renewal tool
• Test the renewal challenge after every infrastructure change
• Audit quarterly against Certificate Transparency logs

SSL, HTTPS and SEO

HTTPS is a confirmed, if lightweight, ranking signal for Google, and browsers label plain HTTP pages as not secure. The bigger SEO risk, however, is a broken certificate. When a certificate expires or does not match, browsers show an interstitial warning that most visitors never click through, so traffic and conversions collapse immediately. Search engine crawlers that cannot establish a trusted connection may also fail to fetch pages, and extended problems can affect how pages are crawled and shown.

For online shops the impact is direct revenue loss: checkout pages behind a security warning do not convert, and payment providers may reject callbacks to an endpoint with an invalid certificate. That is why SSL monitoring belongs in the same category as uptime monitoring and response time monitoring – it protects availability, just through a different failure mode.

SSL monitoring mistakes to avoid

The most common mistake is monitoring only the main domain. Certificates on subdomains, API hosts and mail servers expire just as reliably, and they are the ones nobody remembers. The second is relying on the renewal tool’s own success messages instead of checking the certificate the server actually presents – a renewed certificate that the web server never reloaded is still the old one.

Other frequent errors: checking from inside the network where a different certificate is served, ignoring chain warnings because the site works in one browser, sending reminders to a personal address, and treating the 30-day warning as optional. Each of these has caused real outages. A monitoring setup that checks every hostname from outside, validates the whole chain and alerts a shared role avoids all of them.

Where monitordefend fits

monitordefend is a hosted website monitoring service and does not offer SSL certificate monitoring with expiry warnings. For a quick look at any certificate – issuer, covered hostnames, validity dates and days left – use the free SSL checker above, no signup needed. Within monitoring, the uptime check requests each site’s homepage over HTTPS every five minutes with certificate validation enabled, so an expired or otherwise broken homepage certificate shows up as an outage with an email alert – a safety net for the moment it breaks, not an advance warning.

Frequently asked questions

What is SSL monitoring?

SSL monitoring is the continuous checking of SSL/TLS certificates on websites, servers and other services. It detects expired, soon-to-expire, misconfigured and untrusted certificates so you can fix them before browsers block visitors, keeping data transmission encrypted and your site trustworthy.

What does an SSL monitoring tool do?

It connects to each endpoint like a browser, reads the certificate, checks the expiry date, hostname coverage, chain of trust and protocol, and sends alerts when a rule is broken – for example when fewer than 30 days remain or the chain is incomplete.

How do you prevent your SSL certificate from expiring?

Automate renewal with ACME or your provider’s auto-renew, keep an inventory of all certificates with owners and dates, monitor expiry independently of the renewal tool with notifications at 30, 14, 7 and 1 day, and audit regularly.

When should SSL expiry notifications be sent?

A staged schedule works best: around 30 days before expiry to plan or debug the renewal, then 14, 7 and 1 day as reminders and escalation. With automated renewal, a certificate under 30 days usually means the automation already failed.

Which SSL certificate errors are most common?

Expired certificates, hostname mismatches, incomplete chains with a missing intermediate, self-signed or untrusted certificates, wrong system clocks and mixed content on otherwise valid HTTPS pages.

Does SSL affect SEO?

HTTPS is a light ranking signal, but a broken certificate is the real risk: browser warnings stop visitors, conversions collapse and crawlers may fail to fetch pages until the certificate is fixed.

Does monitordefend monitor SSL certificate expiry?

No. monitordefend sends no SSL expiry warnings. Its free SSL checker shows a certificate’s status on demand, and its uptime check, which validates the homepage certificate over HTTPS, reports an outage once the certificate is broken.

Related pages

• SSL certificate checker
• SSL Certificate
• DNS monitoring: protect your website from DNS changes and outages
• Domain expiration monitoring: don’t let your domains slip away
• The All-in-One Website Monitoring Tool