How to Monitor SSL Certificate Expiry (and Never Get Caught Out)

Published 22 July 2026 · 6-minute read

An expired SSL certificate takes a site down as completely as a crashed server — the browser throws a full-page security warning and every visitor bounces. The frustrating part is that it's entirely predictable, and still happens to teams every year.

Why certificates still expire in the age of auto-renewal

Let's Encrypt and most modern hosts auto-renew certificates, so it's tempting to assume expiry is a solved problem. In practice, renewals fail quietly for reasons that have nothing to do with the certificate itself:

• The renewal cron job silently stopped after a server migration or OS upgrade.
• A firewall or DNS change broke the ACME HTTP/DNS challenge, so validation fails.
• The certificate is on a load balancer, CDN, or appliance that isn't on auto-renewal — someone uploaded it by hand a year ago and forgot.
• A wildcard or multi-domain (SAN) certificate was renewed for some hostnames but not the one that mattered.

None of these show up until the certificate actually lapses — unless something is watching the expiry date independently of whatever is supposed to be renewing it.

What "monitoring SSL expiry" actually means

Good certificate monitoring does three things on a schedule, from outside your infrastructure:

1. Connects over TLS to the live hostname and reads the certificate the server is actually serving — not the one you think is deployed.
2. Checks the notAfter date and calculates days remaining.
3. Alerts you with enough lead time to fix a broken renewal before visitors ever see a warning.

That last point matters most. Getting told a certificate expired this morning is not monitoring — it's a post-mortem. You want the warning while there's still time to act.

How much lead time do you need?

Two weeks is a sensible default. It's long enough to survive a weekend, a holiday, or a renewal that needs a manual DNS change, but short enough that the alert still feels urgent. For certificates you renew by hand (appliances, some enterprise CAs), bump the warning to 30 days.

Rule of thumb: your warning window should be at least twice as long as it would take you to manually issue and deploy a replacement certificate on your slowest system.

A simple setup that works

You don't need a dedicated security product for this. The reliable pattern is:

• Monitor every public hostname, not just the apex domain. www, api, app, and status subdomains all have their own certificates.
• Check daily — SSL expiry doesn't need minute-by-minute polling, and daily keeps you well clear of any surprise.
• Route the alert to a channel a human actually reads — email plus a shared Teams or Slack channel, not a dashboard nobody opens.

In UpWatch Robot, SSL monitoring is on by default for every monitor you add. Point it at a URL and it tracks that certificate's expiry daily, warning you two weeks out (configurable per site). There's nothing to wire up — and it's included on every plan, not sold as a paid add-on.

Don't forget the domain itself

A subtle cousin of certificate expiry is domain expiry — the registration lapsing at the registrar. A valid certificate on a domain you forgot to renew is still a dead site. It's worth tracking both together, which is exactly why we built uptime, SSL, and domain-expiry monitoring into one tool.

Frequently asked questions

How often should SSL certificates be checked?

Once a day is enough. Certificate expiry changes slowly and is known well in advance, so daily checks give you plenty of warning without unnecessary load. What matters more than frequency is the lead time on the alert — aim for at least 14 days before expiry.

Why do auto-renewed certificates still expire?

Auto-renewal fails silently for reasons unrelated to the certificate: a broken renewal cron after a server change, a firewall or DNS change that breaks the ACME validation challenge, or certificates living on a load balancer or CDN that isn't on auto-renewal at all. Independent monitoring catches these before visitors do.

Should I monitor every subdomain's certificate?

Yes. Subdomains like www, api, app and status typically have their own certificates with their own expiry dates and renewal paths. Monitoring only the apex domain leaves the rest unwatched.