SSL Certificate Expiration Monitoring: Never Let Your Cert Expire Again

An expired SSL certificate is one of the most preventable causes of website downtime. Yet it happens to major companies every year. The fix is simple: monitor certificate expiration dates and get alerts before they expire.

Why SSL Certificate Monitoring Matters

When an SSL certificate expires:

• Browsers show security warnings — Chrome, Firefox, and Safari block access or show scary interstitial pages
• Users can't access your site — most people won't click through security warnings
• API integrations break — any service calling your API over HTTPS fails
• SEO rankings drop — Google penalizes sites with certificate errors
• Revenue stops — e-commerce sites lose every transaction

The worst part? Let's Encrypt certificates expire every 90 days. If you're not monitoring, you're one missed renewal away from an outage.

How SSL Certificates Work

Understanding certificates helps you monitor them better:

Certificate Authority (CA) — the entity that issues the certificate (Let's Encrypt, DigiCert, Comodo)

Validity Period — how long the certificate is valid (90 days for Let's Encrypt, 1 year for paid CAs)

Certificate Chain — your certificate, intermediate certificates, and the root CA. All must be valid.

Common Names (SANs) — the domain names the certificate covers. A certificate for example.com doesn't cover www.example.com unless explicitly included.

What to Monitor

Track these certificate properties:

Expiration Date. The most critical metric. Alert at:

• 30 days: Warning
• 14 days: Urgent
• 7 days: Critical

Certificate Chain. Ensure intermediate certificates are properly installed. Chain issues cause errors even if the leaf certificate is valid.

Subject Alternative Names (SANs). Verify all domains you expect to be covered actually are.

Certificate Type. Track whether you're using DV, OV, or EV certificates. Ensure renewals maintain the correct type.

OCSP Stapling. Monitor whether OCSP stapling is enabled and working. Disabled OCSP can cause slower connections.

Setting Up SSL Monitoring

Using Command Line

Quick check from your terminal:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

This shows the notBefore and notAfter dates for the certificate.

Automated Monitoring Script

#!/bin/bash
DOMAIN="example.com"
DAYS_WARNING=14

expiry=$(echo | openssl s_client -servername $DOMAIN -connect $DOMAIN:443 2>/dev/null | openssl x509 -noout -enddate | cut -d= -f2)
expiry_epoch=$(date -d "$expiry" +%s)
current_epoch=$(date +%s)
days_left=$(( ($expiry_epoch - $current_epoch) / 86400 ))

if [ $days_left -lt $DAYS_WARNING ]; then
  echo "WARNING: $DOMAIN certificate expires in $days_left days"
  # Send alert here
fi

Using Monitoring Services

Most uptime monitoring tools include SSL checks:

• UptimeRobot — free SSL monitoring with email alerts
• UptimePulse — SSL monitoring with 14-day advance alerts
• SSL Labs — free deep analysis of your certificate configuration
• Datadog — enterprise SSL monitoring with dashboard integration

SSL Certificate Best Practices

Use Automated Renewal

Let's Encrypt with Certbot automates renewal. Set up a cron job:

# Renew certificates daily, reload nginx if successful
0 0 * * * certbot renew --quiet --deploy-hook "systemctl reload nginx"

Monitor Before and After Renewal

Don't assume renewal worked. After each renewal:

1. Check the new expiration date
2. Verify the certificate chain is complete
3. Test HTTPS access from multiple locations

Keep Track of Certificate Inventory

Maintain a list of all certificates across your infrastructure:

• Domain names covered
• Issuing CA
• Expiration date
• Renewal method
• Responsible team

Test Certificate Configuration

Use SSL Labs to audit your configuration:

• Grade should be A or A+
• HSTS should be enabled
• OCSP stapling should be active
• Protocol versions should be TLS 1.2+

Common SSL Monitoring Mistakes

Monitoring only the leaf certificate. The intermediate certificate can expire too. Monitor the full chain.

Ignoring internal certificates. Internal services using self-signed or internally-issued certificates need monitoring just as much.

Not testing after renewal. Automated renewals can fail silently. Always verify the new certificate is actually in use.

Using email-only alerts. Email might not reach you during an incident. Use multiple alert channels.

The Cost of Expired Certificates

Major outages from expired SSL certificates have hit companies like:

• Microsoft (Azure DevOps)
• Stack Overflow
• GitHub (partial)

These were all preventable with basic certificate monitoring.

Getting Started

Set up SSL monitoring today:

1. List all your domains and subdomains
2. Check current certificate expiration dates
3. Set up automated monitoring with alerts at 30, 14, and 7 days
4. Configure automated renewal for Let's Encrypt certificates
5. Test your monitoring by checking a known-expired certificate

Certificate monitoring takes 5 minutes to set up and prevents hours of downtime.