SSL certificate expiration monitoring: complete guide

SSL certificate expiration monitoring succeeds when every revenue hostname is probed from the public internet on a schedule—not when a quarterly spreadsheet remembers the apex cert from last year’s invoice.

Platform engineers, security champions, and small-business owners share one anxiety: learning about expiry from a customer screenshot. ACME automation reduced manual purchases but introduced reload gaps, CDN attachment drift, and shadow hostnames that never entered inventory.

The failure mode is monitoring files on disk while customers handshake with an older listener binding. Another is trusting uptime green without PKIX validation—the site returns HTTP 200 while browsers block checkout.

This hub is the pillar for ssl certificate expiration monitoring: what to measure, how often, which alerts fire, and where RDAP registration dates sit beside TLS notAfter.

What this guide covers

Focus is public hostname presentation: leaf expiry, issuer trust, SAN fit, and optional registration correlation. Internal mesh mTLS and code signing belong in other runbooks unless they block external deploys.

E-commerce teams need checkout, API, and auth names enrolled before marketing microsites. SaaS buyers should map every tenant-facing hostname from contracts, not only the domain printed on business cards.

Agencies rolling monitoring to clients should standardize naming (production vs staging labels) before importing fifty similar brands.

Key concepts

Live TLS means completing a TCP connect and handshake to the hostname end users type, then reading served material—including redirects you expect production to follow.

Inventory by hostname beats inventory by certificate SKU. One SAN certificate may protect dozens of hosts; each public name deserves its own row unless you explicitly delegate monitoring to a parent redirect chain.

Threshold ladders typically warn at 30, 14, 7, and 1 days before notAfter, once per threshold per renewal cycle, so renewed certs do not spam on-call nightly.

Check interval trades cost against detection speed. Daily checks suit low-churn brochures; hourly suits auth and payment paths where Friday-night deploy mistakes must not wait until Monday dashboards.

RDAP layers registrar expiry beside TLS for the registrable domain tied to each hostname—useful but not a substitute for handshake data.

How to work through your portfolio

Export every hostname that appears in customer URLs, mobile deep links, and partner callbacks. Remove duplicates after normalizing www vs apex policy.

Validate a row before enrolling it:

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
  | openssl x509 -noout -dates -issuer -ext subjectAltName

Confirm SAN coverage includes the exact name users hit. If your CDN terminates TLS, probe the customer-facing name, not only the origin IP.

For redirects, decide which hop is authoritative. Document whether monitors should follow www to apex or alert on each hop separately.

Group hostnames by blast radius: tier zero (payments), tier one (app/API), tier two (marketing). Apply hourly cadence to tier zero even if tier two stays daily on the same account.

After ACME renewals, re-run the same openssl command from an external network. SSL certificate expiration monitoring that only trusts renewal logs misses the classic skipped reload.

Pair handshake checks with internal monitoring vs external SSL check when serial numbers disagree between VPC probes and the public internet.

Related guides in this silo

Practices and cadence

• Best SSL certificate monitoring practices — inventory hygiene and ownership.
• Hourly SSL certificate checks — when daily intervals are too slow.
• Monitor SSL certificates for multiple websites — portfolio import patterns.

Tooling and evaluation

• SSL certificate expiry monitoring tools — buyer checklist.
• Paid vs free SSL monitoring — tier economics.
• Certificate inventory and expiry dashboard — visualization expectations.

Alerts and integrations

• SSL expiry alerts thresholds and channels — on-call routing.
• SSL monitor with Slack alerts — chat escalation.
• Free SSL monitor with email alerts — baseline notifications.

Adjacent risks

• Uptime monitoring vs SSL certificate monitoring — why HTTP success is insufficient.
• Domain and SSL expiry monitoring in one place — two-clock dashboards.

When to use automation

Cron scripts and calendar reminders fail once SAN sprawl exceeds human memory. SSL certificate expiration monitoring products exist to externalize handshakes, dedupe alerts, and survive staff turnover.

ssldays reads the live TLS certificate for each enrolled hostname—issuer, SANs, chain trust, and expiry—as strangers see it. RDAP adds registrar dates where registries publish them. Email alerts use 30, 14, 7, and 1 day thresholds once per cycle. Free monitors 3 domains daily; Starter covers 25 hourly with Slack and Discord webhooks; Pro supports 100 hostnames at the same cadence.

Run /check before onboarding a controversial name, then promote production paths first. Tie monitoring to deploy pipelines so a green renewal log always triggers an external verify step.