SSL certificate monitoring
SSL renewals are easy—until they’re not. Monitoring.app checks the exact HTTPS hostname and port you configure, validates the presented certificate chain and hostname, and records the leaf certificate validity dates.
Certificate issues don’t fail gracefully
A certificate can be “fine” for weeks and then instantly become a business incident: browsers block the site, users stop signing in, and the first notification is a client call.
- • Expired certificates cause hard outages (not just a warning).
- • Renewals sometimes fail silently (DNS, rate limits, ACME challenges).
- • Misconfigurations can affect only some clients (older devices, strict TLS stacks).
What we monitor
We inspect the certificate presented by your HTTPS endpoints and alert you early when something looks risky.
- • Expiry (days left) with early warnings before the deadline.
- • Hostname mismatch basics (CN/SAN vs the domain you’re monitoring).
- • Chain issues (missing intermediate certificates that trigger trust errors).
- • Leaf-certificate validity dates and the configured days-before-expiry threshold.
How it works
Monitor a website, portal, or API hostname (for example: client.example.com).
On each check we look at the certificate dates, the hostname it’s valid for, and the chain presented by the server.
Choose one days-before-expiry threshold per monitor and receive an alert when it is reached or TLS verification fails.
Edge cases we help you avoid
The certificate is valid for a different domain than the one users visit. This happens after migrations, CDN changes, or when the wrong cert gets deployed.
Some servers forget to serve the intermediate certificate. Many clients fail the trust check, even if the leaf cert is valid.
Set the warning window for the monitored hostname so a missed renewal is visible before the leaf certificate expires.
Who needs SSL monitoring?
Protect client sites and avoid the “why is the website insecure?” panic when a renewal fails over the weekend.
Get early warnings across environments (prod + staging) and catch mismatch/chain issues after infrastructure changes.
If your website or portal is your revenue pipeline, SSL failures are outages. Automated reminders are cheaper than emergencies.
FAQ
How early do you alert before a certificate expires?
Choose one days-before-expiry threshold for each SSL monitor. Monitoring.app alerts when that threshold is reached; it does not send an automatic 30/14/7 reminder ladder.
What about Let’s Encrypt renewals—aren’t those automatic?
Often yes, but automation can fail (DNS changes, ACME challenges, rate limits, expired credentials, server rebuilds). SSL monitoring is the safety net that tells you when “automatic” stopped being automatic.
Do you monitor wildcard certificates and SAN certificates?
They work when the certificate covers the exact hostname you configured. Monitoring.app validates that hostname, but it does not inventory every SAN on the certificate.
Is hostname mismatch the same as an expired certificate?
No. A hostname mismatch happens when the certificate doesn’t include the domain your users visit (in the CN or SAN list). The cert may be unexpired, but browsers still show a blocking warning.
Can SSL issues affect only some users?
Yes. Chain issues and trust store differences can show up on specific devices or networks. Monitoring helps catch these problems before they turn into support tickets.
Add your first HTTPS endpoint and get calm, early reminders before certificates expire.