--- title: "SSL Certificate Expiry Monitoring | FourSight" description: "Automate certificate renewal tracking so you never wake up to an expired cert blocking your customers." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "Article", "headline": "SSL Certificate Expiry Monitoring", "description": "Automate certificate renewal tracking so you never wake up to an expired cert blocking your customers.", "author": { "@type": "Organization", "name": "FourSight" }, "publisher": { "@type": "Organization", "name": "FourSight" }, "url": "https://foursight.cloud/guides/ssl-certificate-expiry-monitoring", "mainEntityOfPage": "https://foursight.cloud/guides/ssl-certificate-expiry-monitoring", "datePublished": "2025-06-25", "dateModified": "2025-12-02", "wordCount": 2000 }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://foursight.cloud" }, { "@type": "ListItem", "position": 2, "name": "Guides", "item": "https://foursight.cloud/guides" }, { "@type": "ListItem", "position": 3, "name": "SSL Certificate Expiry Monitoring", "item": "https://foursight.cloud/guides/ssl-certificate-expiry-monitoring" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "How early should I be alerted before SSL expires?", "acceptedAnswer": { "@type": "Answer", "text": "30 days for the first warning, 14 days for escalation, 7 days for critical paging. The 30-day window catches silent auto-renewal failures while there's still time to resolve them calmly. Anything less than 7 days assumes you'll see and act on the alert immediately, which isn't realistic over weekends." } }, { "@type": "Question", "name": "Does auto-renewal really fail often?", "acceptedAnswer": { "@type": "Answer", "text": "More often than you'd think. Industry surveys show 25-40% of teams running auto-renewal experience at least one silent failure per year. The failure modes (DNS API outages, credential rotations, cloud-account billing issues) are mundane and unrelated to the cert itself, which is why monitoring matters." } }, { "@type": "Question", "name": "What's the difference between SSL expiry and SSL chain monitoring?", "acceptedAnswer": { "@type": "Answer", "text": "Expiry checks the leaf certificate's notAfter date. Chain monitoring validates that your server presents the complete certificate chain and that the chain validates against trusted root CAs. A valid leaf with a broken chain works in Chrome but fails in many other clients." } }, { "@type": "Question", "name": "Should I monitor subdomains separately?", "acceptedAnswer": { "@type": "Answer", "text": "Yes if they use different certificates (which most do). A wildcard cert covers one subdomain level — *.yourdomain.com covers api.yourdomain.com but not v2.api.yourdomain.com. Audit your certs quarterly." } }, { "@type": "Question", "name": "What TLS version should I support?", "acceptedAnswer": { "@type": "Answer", "text": "TLS 1.2 minimum, TLS 1.3 preferred. Drop TLS 1.0 and 1.1 — they're deprecated by all major browsers and create security warnings. The only reason to keep older versions is supporting truly ancient clients." } }, { "@type": "Question", "name": "How do I get an SSL Labs A+ rating?", "acceptedAnswer": { "@type": "Answer", "text": "Use TLS 1.2+, AEAD-only ciphers, ECDHE key exchange, OCSP stapling, HSTS with includeSubDomains and preload, and a valid certificate from a trusted CA. Configure your web server to match the Mozilla 'Intermediate' profile." } }, { "@type": "Question", "name": "What happens if my cert expires and I don't notice?", "acceptedAnswer": { "@type": "Answer", "text": "Browsers display a full-screen scary warning that most users immediately bounce from. Mobile apps with cert pinning stop connecting. Stripe webhooks fail to deliver. SEO rankings drop within 24-48 hours. Total business impact of a 4-hour expiry on a mid-stage SaaS is typically $5K-50K in lost revenue plus brand damage." } }, { "@type": "Question", "name": "Can I monitor SSL without exposing internal endpoints?", "acceptedAnswer": { "@type": "Answer", "text": "FourSight checks SSL via standard TLS handshake — same as any web browser. It doesn't need any special access to your server beyond what's already publicly reachable." } } ] } ] --- [FourSight ](/) [Features](/#features)[Pricing](/pricing)[Guides](/guides)[Glossary](/glossary)[FAQ](/faq) [Login](/auth)[Start free](/auth?signup=true) [Start free](/auth?signup=true) [All Guides](/guides) Reliability & Infrastructure # SSL Certificate Expiry Monitoring Automate certificate renewal tracking so you never wake up to an expired cert blocking your customers. 10 min read Guide Published Jun 25, 2025Updated Dec 2, 2025 ## The SSL Expiry Time Bomb An expired [SSL](/glossary/ssl-tls "Glossary: SSL") certificate is one of the most preventable — and most embarrassing — outages a SaaS company can suffer. Modern browsers block access entirely with full-screen 'Your connection is not private' warnings that look terrifying to users. Mobile apps that pin certificates fail to connect at all. Webhook senders like Stripe and GitHub refuse to deliver events. Search engines penalize the domain. The fix is usually trivial — renew and redeploy — but the damage to brand and conversions can take weeks to recover. ## Why Auto-Renewal Isn't Enough [Let's Encrypt](/glossary/lets-encrypt "Glossary: Let's Encrypt"), AWS Certificate Manager, Cloudflare, and your hosting provider all offer automatic renewal. They work most of the time. The problem is that 'most of the time' is the worst possible failure mode — you assume it's handled, you stop checking, and then it silently breaks. ### DNS Validation Failures ACME challenge validation requires your [DNS](/glossary/dns "Glossary: DNS") provider's API to be reachable during renewal. If your DNS provider has even a brief API outage during the renewal window, the challenge fails. The cert expires 30-60 days later, and unless you have monitoring, you find out from a customer tweet. ### Permission and Credential Changes An IAM policy change, an API key rotation, or a cloud-account billing issue can silently break auto-renewal months before the cert actually expires. The renewal [cron job](/glossary/cron-job "Glossary: cron job") fails silently. You won't know until 60-90 days later. ### Wildcard Certificate Gaps Auto-renewal for wildcard certs often requires DNS-01 validation, which is different from HTTP-01 for single-domain certs. The wildcard covers \*.yourdomain.com but not \*.api.yourdomain.com — and new subdomains may not be covered. ### Provider Migration You moved from Heroku to Vercel six months ago. The old auto-renewal cron is still running on someone's laptop, nobody updated the docs. The cert expires and the entire team rediscovers the old infrastructure during the outage. ### Manually-Issued Certs Any cert you issued by hand for a special case — a country-specific domain, a partner-integration domain, a webhook receiver behind a proxy — is not auto-renewed by anything. These are the most common silent expiries. ## Setting Up SSL Monitoring FourSight's SSL monitor checks your certificate's expiry date, chain validity, and configuration daily. You get alerts at 30, 14, and 7 days before expiry — plenty of time to investigate why auto-renewal hasn't fired, get human eyes on it, and fix the underlying issue without panic. **💡** Monitor SSL on every domain and subdomain you operate, not just your primary one. Webhook endpoints, API subdomains, staging environments, and country-specific TLDs all need separate monitoring — they often use separate certificates with separate renewal mechanisms. ## What to Monitor Beyond Expiry Expiry is the most catastrophic SSL issue but not the only one. A complete SSL monitoring strategy covers configuration as well. Check What It Catches Severity Days until expiry Imminent expiration Critical at < 14 days Chain validity Missing intermediate certs Critical (breaks on some clients) Hostname match Wrong cert for domain Critical TLS version (1.2+) Outdated TLS Warning Cipher suite strength Weak crypto Warning HSTS header Missing security header Info OCSP stapling Slow validation Info Issuer trust Cert from untrusted CA Critical ### Monitoring a Commercial SaaS? FourSight's free plan includes 10 commercial-safe monitors with multi-region validation — free forever, no card. [Start Monitoring Free](/auth?signup=true) ## Certificate Chain Validation An incomplete [certificate chain](/glossary/certificate-chain "Glossary: certificate chain") is the most common SSL gotcha after expiry. Your cert validates fine in Chrome on your laptop but fails on iOS Safari, Android default browsers, and many HTTP clients. The reason: desktop browsers cache intermediate certificates from previous sessions, while mobile and headless clients don't. Always serve the full chain. FourSight validates the entire chain on every check. Related Reading - [→ Monitoring Stripe Webhook Reliability](/guides/monitoring-stripe-webhooks) - [→ DNS Monitoring: Catching Silent Failures](/guides/dns-monitoring-guide) ## SSL Configuration Best Practices Beyond expiry and chain, monitor your SSL configuration for security issues. Weak cipher suites and outdated TLS versions don't cause outages — but they create vulnerabilities and harm your SEO ranking. Google has used HTTPS as a ranking signal since 2014. ``` Target SSL configuration: TLS versions: TLS 1.2 minimum, TLS 1.3 preferred Cipher suites: AEAD ciphers only (AES-GCM, ChaCha20-Poly1305) Key exchange: ECDHE with P-256 or X25519 Certificate: ECDSA P-256 (preferred) or RSA 2048+ HSTS: max-age=31536000; includeSubDomains; preload OCSP stapling: Enabled Verify your config with: ssllabs.com (rating: A or A+) testssl.sh (run weekly in CI) ``` ## Multi-Domain Monitoring Strategy Most SaaS companies have more SSL certificates than they realize. Audit your entire surface area at least quarterly. A typical mid-stage SaaS has 8-15 distinct certificates spread across primary domain, www, API subdomain, app subdomain, webhook endpoint, status page, marketing site, docs site, and legacy redirects. Missing even one creates a silent expiry risk. Related Reading - [→ Status Page Best Practices for SaaS](/guides/status-page-best-practices) - [→ Monitoring for Solo Founders](/guides/monitoring-for-solo-founders) ## What to Do During an SSL Outage If a cert expires anyway, time matters. Document the renewal steps for each cert in a runbook accessible from anywhere. For Let's Encrypt, manual renewal usually takes 5-10 minutes. While renewing, post on your status page immediately — the support volume during an SSL outage is enormous because every user is hitting a scary browser warning at the same time. ## Frequently Asked Questions ### How early should I be alerted before SSL expires? ### Does auto-renewal really fail often? ### What's the difference between SSL expiry and SSL chain monitoring? ### Should I monitor subdomains separately? ### What TLS version should I support? ### How do I get an SSL Labs A+ rating? ### What happens if my cert expires and I don't notice? ### Can I monitor SSL without exposing internal endpoints? #### Related Guides [What Is Uptime Monitoring? The Complete Guide 12 min ](/guides/what-is-uptime-monitoring)[Multi-Region Monitoring Explained 8 min ](/guides/multi-region-monitoring-explained)[How SSL Certificates Expire Silently: The Failure Modes 8 min ](/guides/how-ssl-certificates-expire-silently)[Let's Encrypt Auto-Renewal Failures: ACME Failure Modes Explained 9 min ](/guides/lets-encrypt-renewal-failures) #### Compare FourSight [vs UptimeRobot →](/compare/uptimerobot-alternative)[vs StatusCake →](/compare/statuscake-alternative)[vs Pingdom →](/compare/pingdom-alternative) 10 free commercial-safe monitors [View Pricing](/pricing) ## Protect Your SaaS Revenue Start monitoring in under 60 seconds. [Start Monitoring Free](/auth?signup=true)[View Pricing](/pricing) FourSight © 2026 [TetraCore](https://tetracorehq.com/). All rights reserved. FourSight is a TetraCore product — Bowling Green, Ohio. Product [Pricing](/pricing)[Guides](/guides)[Glossary](/glossary)[FAQ](/faq)[About](/about)[For Agencies](/solutions/agencies)[For Startups](/solutions/startups)[Privacy](/privacy)[Terms](/terms) Features [Cron Job & Heartbeat Monitoring](/features/cron-job-monitoring)[SSL Certificate Monitoring](/features/ssl-monitoring)[Status Pages](/features/status-pages)[Domain Expiry Monitoring](/features/domain-expiry-monitoring)[DNS Monitoring](/features/dns-monitoring)[Port Monitoring](/features/port-monitoring) Compare [All comparisons](/compare)[vs UptimeRobot](/compare/uptimerobot-alternative)[vs StatusCake](/compare/statuscake-alternative)[vs Freshping](/compare/freshping-alternative)[vs Pingdom](/compare/pingdom-alternative)[vs Pulsetic](/compare/pulsetic-alternative)[vs Better Stack](/compare/better-stack-alternative)[vs Uptime Kuma](/compare/uptime-kuma-alternative)[vs Cronitor](/compare/cronitor-alternative)[vs Healthchecks.io](/compare/healthchecks-alternative)[vs Hyperping](/compare/hyperping-alternative) Pricing Guides [UptimeRobot Pricing](/compare/uptimerobot-pricing)[StatusCake Pricing](/compare/statuscake-pricing)[Pingdom Pricing](/compare/pingdom-pricing)[Better Stack Pricing](/compare/better-stack-pricing)[Uptime Kuma Pricing](/compare/uptime-kuma-pricing)[Cronitor Pricing](/compare/cronitor-pricing)[Healthchecks.io Pricing](/compare/healthchecks-pricing)[Hyperping Pricing](/compare/hyperping-pricing)[Pulsetic Pricing](/compare/pulsetic-pricing)