SSL certificate monitoring that warns you weeks before expiry
UptimePilot reads the certificate your server actually serves, from US East and EU Central, on every check. It tracks the expiry date, the issuer, the chain and the hostnames the certificate covers, and warns your team at the thresholds you choose, long before a browser shows visitors a full page security warning.
Why SSL certificate expiry monitoring still matters
Automated renewal removed most of the manual work, but not the failures. A renewal job stops after a server move. A new certificate lands on disk while the web server keeps serving the old one until the next reload. A load balancer or edge layer holds a certificate that nobody remembers uploading. A DNS change breaks domain validation, and the renewal client retries quietly until the last day.
An expired certificate is not a small defect. Browsers block the page, API clients refuse the connection, mobile apps stop syncing and payment callbacks fail. For every client that validates TLS, which is nearly all of them, it is a full outage.
- Expiry warnings at the number of days you choose
- The certificate that is really served, not the one on disk
- Chain problems such as a missing intermediate certificate
- Hostname mismatch after a migration or a new subdomain
- A changed issuer, which often means someone replaced the certificate by hand
What SSL certificate monitoring checks on every run
| Check | What UptimePilot looks at |
|---|---|
| Expiry date | Days left until the certificate expires, with alerts at your thresholds |
| Chain validity | Whether the served chain is complete and leads to a trusted root |
| Hostname | Whether the certificate covers the exact hostname you monitor |
| Issuer | Who issued the certificate, with a note when it changes |
| Subject alternative names | The list of hostnames the certificate covers |
| Protocol | The TLS version negotiated during the handshake |
Every result is stored, so the monitor history shows each renewal as a new expiry date and makes a missed renewal obvious at a glance.
Expiry warnings at 30, 14, 7 and 1 days
The default schedule sends a warning 30 days before expiry, then 14, 7 and 1. You can change the days per monitor. A certificate that renews automatically every 60 days should never reach the 14 day warning, so that alert is a reliable signal that renewal failed. Send the early warnings by email or Slack, and route the 7 day and 1 day warnings to SMS or to the on-call person through escalation.
Warnings stop as soon as the check sees a new certificate with a later expiry date, so nobody has to close an alert by hand after a successful renewal.
How SSL monitoring works on UptimePilot
- 01 Add an SSL monitor, or enable certificate checks on an existing website or API monitor.
- 02 Enter the hostname and port. Port 443 is the default, and any other TLS port works the same way.
- 03 Choose the warning days and the alert channels: email, SMS, Slack, Microsoft Teams or webhook.
- 04 UptimePilot connects with the correct server name, reads the served certificate and chain, and records the result.
- 05 When a threshold is crossed or the chain breaks, your team gets an alert with the hostname, the days left, the issuer and the exact problem.
Monitor every hostname, not just the main domain
A certificate on the main domain says nothing about the API host, the checkout subdomain, the status page or the mail server. Each hostname can be served by a different machine, a different edge layer and a different renewal process. Add one SSL monitor per hostname that customers or partners connect to, and group them per project or client so reports follow the same structure.
Edge and origin certificates
When traffic passes through an edge layer or a load balancer, visitors see the edge certificate, while the edge itself connects to an origin certificate you also manage. Both can expire. Monitor the public hostname for the certificate visitors see, and if your origin is reachable on its own hostname, monitor that as well, so an expired origin certificate does not surprise you during a failover.
Wildcard and multi domain certificates
A wildcard certificate can cover dozens of subdomains, so one missed renewal takes many services down at once. Monitoring a single hostname is enough to track the expiry date, but checking each important subdomain also confirms that every server actually received the renewed certificate.
Pair certificates with domain expiry
An expired domain is worse than an expired certificate, because DNS stops resolving and email stops arriving. Add domain expiration monitoring next to certificate checks. For a deeper look at why renewals still fail, read ssl certificate expiry. For the availability of the site itself, use website monitoring.
SSL certificate monitoring on every plan
| Plan | Monitors | Interval | Team members | Monthly, or billed yearly |
|---|---|---|---|---|
| Starter | 50 | 1 minute | 3 | $49, or $24 per month yearly |
| Team | 200 | 30 seconds | 10 | $99, or $49 per month yearly |
| Business | 1,000 | 30 seconds | 25 | $249, or $124 per month yearly |
| Enterprise | 3,000 | 30 seconds | 100 | $599, or $299 per month yearly |
Certificate checks, chain validation and expiry warnings are included on every plan. Compare all limits on uptime monitoring pricing.
01
How early does SSL certificate monitoring warn me?
By default at 30, 14, 7 and 1 days before expiry. You can set your own days per monitor.
02
Does it check the certificate my server actually serves?
Yes. UptimePilot connects to the hostname with the correct server name and reads the certificate and chain returned in the handshake, which is what browsers and API clients see.
03
Will it catch a missing intermediate certificate?
Yes. An incomplete chain is reported as a chain problem, even when some browsers still accept the certificate because they cached the intermediate.
04
Can I monitor certificates on ports other than 443?
Yes. Enter any TLS port, for example a mail server or an API on a custom port.
05
What happens after a successful renewal?
The next check sees the new expiry date, warnings stop on their own, and the history shows the renewal.
06
Do I need a separate monitor for every subdomain?
Each hostname can be served by a different server, so we recommend one monitor per hostname that customers use. Monitors count toward the limit of your plan.
Never serve an expired certificate again
Add your main domain, your API host and your checkout subdomain. UptimePilot reads their certificates right away and tells you how many days each one has left.