Why expired certs still happen
- DNS validation breaks after a registrar change.
- Renewal cron jobs silently fail on a migrated host.
- Acme rate limits suspend renewal for 7 days.
- An admin removes the renewal workflow during a cleanup.
Monitoring
SSL Expiration Monitoring Guide
Expired SSL certificates are one of the most preventable outages on the web. A quiet monitor that warns you 14 days ahead turns a Sunday-morning incident into a Tuesday-afternoon ticket. Here's how to set it up.
Quick summary
- Set warnings 14 days ahead, critical 3 days ahead.
- Monitor public hostnames, not internal hosts.
- Always monitor — even when auto-renewal is configured.
- Pair with DNS monitoring so validation paths stay intact.
What a good alert looks like
"SSL certificate for example.com expires in 10 days." That's enough detail to act on — no panic copy, no red banners. Once you renew, the next monitor run clears the alert automatically.
Troubleshooting workflow
Run through these steps in order. Each step links to the right diagnostic tool.
- 1
- 2
- 3
- 4
Frequently asked questions
How early should I be warned?
14 days is comfortable for most teams. 30 days for slow change-control environments. 3 days should be a critical alert.
What if my cert auto-renews?
Still monitor it. Auto-renewal silently fails when DNS validation breaks or rate limits kick in — the monitor is your last line of defense.
Do wildcards and SANs change anything?
No. Monitor the public hostname that customers actually see. The cert's other SANs renew on the same schedule.
Does this cover internal certificates?
Only public, internet-reachable hosts. Internal CAs need an internal monitoring tool.
Monitor it continuously
Save this check, get alerts on changes, and track multiple domains in one dashboard.