Never serve an expired SSL certificate

Domain Monitor Hub checks your HTTPS certificate every day and warns you before it expires — so visitors never land on a "Not Secure" page and your padlock stays green.

Start monitoring — free
How it works

How SSL certificate expiration monitoring works

Three steps, none of them on your server. Add a domain, and the certificate is read for you from the outside every single day.

1 · Add your domain

Type the domain and you’re done. Nothing is installed, no agent runs anywhere, and your certificate, host and DNS stay exactly as they are.

2 · Daily automated check

Once a day the service opens a normal HTTPS connection to your domain, reads the certificate you are actually serving, and records its expiry date and issuer. Just rotated one? Check SSL now re-reads it on the spot.

3 · Alerts before the deadline

As the expiry date comes into range, reminders go out on your thresholds — by email and Webhook on every plan, and to Discord or Slack from Pro.

Why it matters

An expired certificate breaks trust in an instant

The moment a certificate lapses, every browser throws a full-page "Not Secure" warning — and most visitors turn back right there. It's one of the easiest outages to prevent, because the expiry date is known in advance.

Expiry alerting

Four warnings, each one further from the cliff

SSL expiry uses the same reminder thresholds as your renewal dates: 30, 14, 7 and 1 day before the certificate runs out, plus any custom interval you add. The first one arrives while a fix is still routine; the last one arrives while it is still possible.

  1. 30 days leftPlenty of runway. Schedule the reissue, or find out why automatic renewal hasn’t fired yet.
  2. 14 days leftStill comfortable, but now it’s a task with a date rather than something for later.
  3. 7 days leftRenewal automation has had every chance to work. If the date hasn’t moved, it isn’t going to on its own.
  4. 1 day leftThe last call before browsers start turning your visitors away.

Thresholds are yours to change, and notification groups decide per domain which channels each alert uses.

SSL is one of four signals Domain Monitor Hub watches — alongside domain expiry monitoring, WHOIS change monitoring and DNS monitoring.

Why automatic renewal still needs monitoring

Most certificates renew themselves now. Let’s Encrypt issues for 90 days, certbot or your control panel renews at 60, and for years nobody has to think about it. That is exactly what makes the failure so expensive: the process is invisible while it works, and equally invisible when it stops.

Renewal is not one step but a chain — a timer fires, a challenge is answered, a new certificate is written, and a service reloads to pick it up. Every link can break quietly, and none of them announces itself.

Where the chain breaks quietly

  • The timer stopped. A cron entry or systemd timer removed during a migration, a server rebuild, or a cleanup nobody connected to certificates.
  • The challenge stopped passing. An HTTP-01 challenge blocked by a new redirect or firewall rule, or a DNS-01 challenge broken by an edited record — which is why DNS monitoring sits next to this one.
  • Credentials expired. Wildcard certificates renewed over a DNS provider’s API keep working right up until that API token is rotated.
  • Renewed, but never served. The new certificate is on disk and the web server was never reloaded, so the old one is still being handed to every visitor.
  • Renewed on one node only. Behind a load balancer, one host quietly keeps serving yesterday’s certificate.
  • The notice went nowhere. Expiry warnings from the CA go to an address that left the company, or into a shared inbox nobody reads.

What an external check adds

The last two cases are the reason monitoring reads the certificate over the wire rather than trusting a file or a log. Domain Monitor Hub connects to your domain on port 443, takes the certificate your server actually presents, and stores its expiry date and issuer. If a renewal succeeded everywhere except the place that answers your visitors, the date it reads simply doesn’t move — and the countdown keeps running toward your thresholds.

It is the same argument as domain expiry, one layer up: the certificate’s end date is knowable months in advance, so an outage caused by it is entirely optional.

What isn’t checked

Worth being just as clear about the boundary. This watches the expiry date and issuer of the certificate being served. It deliberately does not validate the trust chain, so an expired or self-signed certificate can still be read and reported instead of failing silently. It does not test hostname mismatches, revocation status, cipher suites or TLS versions, and it is not a certificate management or issuance tool — renewal stays wherever it lives today.

Need an answer for one domain right now, without an account? The free SSL expiry checker reads the same certificate the same way.

Questions, answered

SSL monitoring FAQ

Once a day, automatically, for every domain you add. If you have just rotated a certificate and don't want to wait for the next run, Check SSL now on the domain page re-reads it immediately.

No. Nothing is installed and nothing runs on your side. The service connects to your domain on port 443 the same way a browser does, reads the certificate you are serving, and closes the connection.

Any certificate a public host presents — Let's Encrypt and commercial CAs alike, including wildcard and multi-domain certificates. Nothing is assumed about who issued it: whatever your server serves is what gets read, and its issuer is recorded alongside the expiry date.

The daily check keeps reading the old certificate, so its expiry date stops moving away — and as that date approaches, your thresholds fire in order. A renewal that quietly stopped working is exactly the failure these alerts exist to catch.

Keep your padlock green, automatically

Add your domains and let Domain Monitor Hub watch every certificate for you — around the clock.

Create your free account
Free forever for 3 domains · No credit card · Sign in with Google