--- title: "SSL Monitoring for Agencies & Multi-Client Teams | FourSight" description: "Monitoring certificates across dozens of client domains you don't fully control: inventory, alert routing, client reporting, and commercial-use-safe tooling." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "Article", "headline": "SSL Monitoring for Agencies & Multi-Client Teams", "description": "Monitoring certificates across dozens of client domains you don't fully control: inventory, alert routing, client reporting, and commercial-use-safe tooling.", "author": { "@type": "Organization", "name": "FourSight" }, "publisher": { "@type": "Organization", "name": "FourSight" }, "url": "https://foursight.cloud/guides/ssl-monitoring-for-agencies", "mainEntityOfPage": "https://foursight.cloud/guides/ssl-monitoring-for-agencies", "datePublished": "2026-07-14", "dateModified": "2026-07-14", "wordCount": 1600 }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://foursight.cloud" }, { "@type": "ListItem", "position": 2, "name": "Guides", "item": "https://foursight.cloud/guides" }, { "@type": "ListItem", "position": 3, "name": "SSL Monitoring for Agencies & Multi-Client Teams", "item": "https://foursight.cloud/guides/ssl-monitoring-for-agencies" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "How should an agency monitor SSL certificates across many client sites?", "acceptedAnswer": { "@type": "Answer", "text": "One external SSL monitor per client hostname, added at onboarding, validating expiry, chain, and hostname coverage. External checks are the key: they need no client credentials or hosting access, so they deploy uniformly across a portfolio where every client's renewal setup is different. Route alerts per client to the owning account team, with time-based escalation as expiry approaches." } }, { "@type": "Question", "name": "Can I use a free monitoring plan for client work?", "acceptedAnswer": { "@type": "Answer", "text": "Only if the terms explicitly allow commercial use. Monitoring client sites is commercial use, and some free tiers prohibit it — UptimeRobot's free plan is non-commercial only under its announced 2025 policy (verify current terms with the vendor). FourSight's free tier explicitly permits commercial and client use, with 10 monitors; paid tiers start at $16/mo." } }, { "@type": "Question", "name": "How many monitors does a typical agency portfolio need?", "acceptedAnswer": { "@type": "Answer", "text": "Plan for roughly three TLS hostnames per client (apex/www, an app or booking subdomain, sometimes mail), so a 30-client portfolio is around 90 SSL monitors before HTTP checks. That lands in the 100-250 monitor range — FourSight's Growth ($40/mo) or Pro ($80/mo) tiers — and makes flat pricing meaningfully cheaper than per-monitor models at scale." } }, { "@type": "Question", "name": "What should I do when a client's certificate is expiring and they won't respond?", "acceptedAnswer": { "@type": "Answer", "text": "Escalate in writing on a documented timeline: day-to-day contact at 30 days, business owner at 14, their emergency contact plus a plain-language impact statement ('every visitor sees a security warning starting the 24th') inside 7. Offer to take over renewal management as the permanent fix, and keep the notification log — it's your reputational protection if the certificate expires anyway." } }, { "@type": "Question", "name": "Should each client get their own status page?", "acceptedAnswer": { "@type": "Answer", "text": "For retainer clients, yes — a per-client status page showing uptime and certificate health is a permanent, self-serve demonstration of custody, and white-label options let it carry your brand. FourSight supports up to 25 status pages on Scale ($160/mo) with custom domains and white-labeling; smaller portfolios fit the 5-10 pages on Growth and Pro." } } ] } ] --- [FourSight ](/) [Features](/#features)[Pricing](/pricing)[Guides](/guides)[Glossary](/glossary)[FAQ](/faq) [Login](/auth)[Start free](/auth?signup=true) [Start free](/auth?signup=true) [All Guides](/guides) Reliability & Infrastructure # SSL Monitoring for Agencies & Multi-Client Teams Monitoring certificates across dozens of client domains you don't fully control: inventory, alert routing, client reporting, and commercial-use-safe tooling. 8 min read Guide Published Jul 14, 2026 ## Client Certificates Are Your Problem, Even When They're Not Your Fault Agencies and multi-client teams occupy the worst seat in the certificate-expiry theater: responsible for outcomes on domains they don't fully control. The client owns the registrar account, the [DNS](/glossary/dns "Glossary: DNS") may sit with a hosting company chosen years ago, renewal automation — if it exists — was configured by a predecessor, and when the certificate expires anyway, the browser warning appears on a site with your agency's name in the footer and your monthly invoice in the client's inbox. Whether [SSL](/glossary/ssl-tls "Glossary: SSL") is contractually your responsibility barely matters; reputationally it always is. The discipline that separates agencies that get the 3 AM panic call from agencies that send the calm 'we caught this three weeks early' email is not deeper TLS expertise — it's inventory, monitoring, alert routing, and reporting, systematized across every client at once. Related Reading - [→ Feature: SSL certificate monitoring](/features/ssl-monitoring) ## Why Client Estates Fail Differently Your own infrastructure has one renewal story you can standardize. A 30-client portfolio has 30 different stories, and the variance is the risk. One client is on managed WordPress hosting that auto-renews flawlessly; another has a certbot cron on a VPS nobody has SSH'd into since the developer who set it up left; a third bought a 1-year certificate through their registrar and renewal is a calendar entry in someone's personal calendar. You often can't fix these renewal paths — the client controls the hosting relationship — which inverts the usual advice: when you can't own the renewal, you must own the detection. External monitoring is the only layer an agency can deploy uniformly across every client without needing credentials, hosting access, or the client's cooperation, because it observes exactly what the public internet observes. Related Reading - [→ How SSL certificates expire silently: the failure modes](/guides/how-ssl-certificates-expire-silently) ## The Client Onboarding Checklist Make certificate discovery a standard onboarding step, not a reaction to the first incident. For every new client, enumerate the hostnames that serve TLS — the apex and www, subdomains for apps or booking systems or landing pages, and the mail domain if you manage email — then establish, in writing, who renews each certificate and how. That second question routinely surprises clients ('we assumed the hosting company handled it'), and surfacing the assumption is precisely the value. Add every hostname to your monitoring the same day; the checklist below compresses the process. ``` Per-client SSL onboarding checklist: [ ] List public hostnames (apex, www, app/booking/landing subdomains) [ ] Check CT logs (crt.sh) for cert history + names the client forgot [ ] For each hostname, record: - current issuer + expiry date - renewal mechanism (host-managed / certbot / manual / unknown) - who fixes a failure (agency / client / hosting vendor + contact) [ ] Flag every "manual" or "unknown" renewal as an elevated risk [ ] Add an SSL monitor per hostname (expiry + chain + host-match) [ ] Route alerts to the account team channel for this client [ ] Record the client's escalation contact for 7-day emergencies ``` Related Reading - [→ How to audit SSL certificates across your fleet](/guides/auditing-ssl-certificates-across-fleet) ### Monitoring a Commercial SaaS? FourSight's free plan includes 10 commercial-safe monitors with multi-region validation — free forever, no card. [Start Monitoring Free](/auth?signup=true) ## Alert Routing at Portfolio Scale Forty clients' worth of certificate alerts dumped into one #monitoring channel recreates the problem monitoring was meant to solve: everything is visible and nothing is seen. Routing needs two dimensions. By client: alerts should reach the account team that owns the relationship, because 'certificate on client X expires in 14 days' is an account-management task (someone may need to chase the client's hosting vendor) before it's a technical one. By urgency: a 30-day warning is a task for this week's client work; a 7-day warning on a still-unrenewed certificate should escalate like an incident, including to the client's own emergency contact if the renewal is on their side. FourSight's escalation policies support this pattern — per-monitor notification routing with time-based escalation — so the 3 AM page goes to your on-call only when a certificate is genuinely days from taking a client's revenue offline. Related Reading - [→ Designing an SSL expiry alerting policy](/guides/ssl-expiry-alerting-policy) ## Turning Monitoring into Retainer Value Certificate monitoring is one of the rare operational disciplines that converts directly into client-visible value. A monthly report line — 'certificates monitored: 4; earliest expiry: 41 days; renewal verified after your host's maintenance on the 12th' — costs minutes to produce from monitoring data and communicates vigilance in terms clients actually understand, because everyone has seen a browser security warning. Client-facing status pages compound this: a page per client showing their site's uptime and certificate health gives the retainer a permanent, self-serve artifact. On FourSight, status pages scale with plan tier (up to 25 on Scale, with white-label branding and custom domains), which maps naturally onto per-client pages that carry your agency's brand rather than your vendor's. The strategic effect is subtle but real: monitoring moves your agency from selling reactive fixes to demonstrating proactive custody. ## Tooling Economics and the Commercial-Use Question Two practical constraints shape agency tooling choices. The first is arithmetic: at roughly three TLS hostnames per client, a 30-client portfolio needs about 90 SSL monitors before counting HTTP checks — so per-monitor and per-seat pricing models deserve scrutiny at portfolio scale. FourSight's flat tiers put that estate in Growth ($40/mo, 100 monitors) or Pro ($80/mo, 250 monitors, SMS alerts), with all 8 check types included rather than priced as add-ons. The second constraint is frequently missed: terms of service. Monitoring client sites is commercial use by any reasonable definition, and some free tiers prohibit exactly that — UptimeRobot's free plan is restricted to non-commercial use per its announced 2025 policy (as published July 2026; verify current terms with the vendor). An agency running client monitoring on a non-commercial free tier has built its early-warning system on an account that can be suspended for cause. FourSight's free tier explicitly permits commercial use, including client work — though at 10 monitors it's a starting point for a small portfolio, not a 30-client solution. [See flat-rate plans for client portfolios →](/pricing) Related Reading - [→ Can you use UptimeRobot for commercial SaaS?](/guides/uptimerobot-commercial-use) - [→ How to choose an SSL monitoring tool](/guides/choosing-an-ssl-monitoring-tool) ## When the Client Won't Act Every agency eventually holds a 14-day warning for a certificate only the client can renew, while the client doesn't respond. Handle it as documented escalation: log each notification with dates, escalate past your day-to-day contact to the business owner as the window narrows, and state the impact in business language — 'your booking site will show a security warning to every visitor starting the 24th' lands where 'your [TLS certificate](/glossary/certificate "Glossary: TLS certificate") lapses' doesn't. Offer the structural fix alongside the warning: agencies that take over renewal management (moving the client onto automation they control, or reselling managed hosting) convert a recurring fire drill into retainer scope. And when a client declines both the fix and the urgency, the paper trail your monitoring generated is what distinguishes 'the agency warned us five times' from 'the agency let our site break' — a distinction worth every minute of the documentation. ## Frequently Asked Questions ### How should an agency monitor SSL certificates across many client sites? ### Can I use a free monitoring plan for client work? ### How many monitors does a typical agency portfolio need? ### What should I do when a client's certificate is expiring and they won't respond? ### Should each client get their own status page? #### Related Guides [What Is Uptime Monitoring? The Complete Guide 12 min ](/guides/what-is-uptime-monitoring)[Multi-Region Monitoring Explained 8 min ](/guides/multi-region-monitoring-explained)[SSL Certificate Expiry Monitoring 10 min ](/guides/ssl-certificate-expiry-monitoring)[How SSL Certificates Expire Silently: The Failure Modes 8 min ](/guides/how-ssl-certificates-expire-silently) #### Compare FourSight [vs UptimeRobot →](/compare/uptimerobot-alternative)[vs StatusCake →](/compare/statuscake-alternative)[vs Pingdom →](/compare/pingdom-alternative) 10 free commercial-safe monitors [View Pricing](/pricing) ## Protect Your SaaS Revenue Start monitoring in under 60 seconds. [Start Monitoring Free](/auth?signup=true)[View Pricing](/pricing) FourSight © 2026 [TetraCore](https://tetracorehq.com/). All rights reserved. FourSight is a TetraCore product — Bowling Green, Ohio. Product [Pricing](/pricing)[Guides](/guides)[Glossary](/glossary)[FAQ](/faq)[About](/about)[For Agencies](/solutions/agencies)[For Startups](/solutions/startups)[Privacy](/privacy)[Terms](/terms) Features [Cron Job & Heartbeat Monitoring](/features/cron-job-monitoring)[SSL Certificate Monitoring](/features/ssl-monitoring)[Status Pages](/features/status-pages)[Domain Expiry Monitoring](/features/domain-expiry-monitoring)[DNS Monitoring](/features/dns-monitoring)[Port Monitoring](/features/port-monitoring) Compare [All comparisons](/compare)[vs UptimeRobot](/compare/uptimerobot-alternative)[vs StatusCake](/compare/statuscake-alternative)[vs Freshping](/compare/freshping-alternative)[vs Pingdom](/compare/pingdom-alternative)[vs Pulsetic](/compare/pulsetic-alternative)[vs Better Stack](/compare/better-stack-alternative)[vs Uptime Kuma](/compare/uptime-kuma-alternative)[vs Cronitor](/compare/cronitor-alternative)[vs Healthchecks.io](/compare/healthchecks-alternative)[vs Hyperping](/compare/hyperping-alternative) Pricing Guides [UptimeRobot Pricing](/compare/uptimerobot-pricing)[StatusCake Pricing](/compare/statuscake-pricing)[Pingdom Pricing](/compare/pingdom-pricing)[Better Stack Pricing](/compare/better-stack-pricing)[Uptime Kuma Pricing](/compare/uptime-kuma-pricing)[Cronitor Pricing](/compare/cronitor-pricing)[Healthchecks.io Pricing](/compare/healthchecks-pricing)[Hyperping Pricing](/compare/hyperping-pricing)[Pulsetic Pricing](/compare/pulsetic-pricing)