The most preventable cause of downtime
SSL certificate expiration might be the single most preventable cause of website outages. Certificates expire predictably. You know the exact date months in advance. Yet expired certificates take down major websites every year.
When a certificate expires, browsers show a full-page security warning. Users cannot access your site without clicking through a scary “Your connection is not private” message. Most users do not click through. They leave.
For e-commerce sites, an expired certificate means zero sales until it is fixed. For SaaS platforms, it means users cannot log in. For APIs, it means all client connections fail. The business impact is immediate and total.
And the fix is usually simple: renew the certificate and restart the web server. The problem is not the fix. The problem is knowing it needs to be fixed before browsers start showing warnings.
Why teams forget to renew certificates
It seems impossible to forget something with a known deadline months away. But certificate renewal falls through the cracks for predictable reasons.
The person who set up the certificate left the company. Six months later, the renewal notice goes to a deactivated email address. Nobody else knows the certificate exists until it expires.
Auto-renewal failed silently. You set up certbot with auto-renewal. It worked for a year. Then a permission changed, a firewall rule was updated, or a DNS record was modified. The renewal script failed. Nobody noticed because nobody was monitoring it.
The certificate covers multiple subdomains. You added a new subdomain. The certificate does not cover it. Users of that subdomain see a warning. Users of the main domain see nothing wrong.
You use multiple certificate authorities. Different domains, different CAs, different renewal dates. There is no single place to see the status of all your certificates.
What SSL monitoring checks
A good SSL monitor checks more than just the expiry date.
Expiry date: The most obvious check. You want alerts at 30, 14, and 7 days before expiry. Multiple warnings give you time to fix things even if the first alert is missed.
Certificate chain: Is the full chain valid? A missing intermediate certificate breaks the chain and triggers browser warnings, even if the leaf certificate is valid.
Subject and SANs: Does the certificate cover the domain being monitored? A certificate for example.com does not cover api.example.com unless the SANs include it.
Signature algorithm: Is the certificate using a secure algorithm? Certificates signed with SHA-1 are deprecated. Modern browsers reject them.
Key size: RSA keys smaller than 2048 bits are considered weak. ECC keys are preferred for performance.
Revocation status: Has the certificate been revoked by the CA? This is rare but critical. A revoked certificate should be replaced immediately.
Setting up SSL monitoring
SSL monitoring should be automatic. You should not have to remember to check certificate expiry dates manually.
PingWatchdog includes SSL monitoring on every plan. You add a domain, and we check the certificate every 24 hours. You get alerts at 30, 14, and 7 days before expiry. We check the full chain, the subject, the SANs, the signature algorithm, and the key size.
If something is wrong, you know about it before your users do. That is the whole point.
Learn more about PingWatchdog SSL monitoring.
Automating certificate renewal
Monitoring tells you when a certificate is about to expire. Automation prevents the expiry from happening in the first place.
Use certbot with Let’s Encrypt: Let’s Encrypt provides free 90-day certificates with automated renewal. Certbot handles the ACME protocol. Set up a cron job or systemd timer to run certbot renew twice a day. Add a heartbeat monitor to the renewal script so you know if auto-renewal fails.
Use your hosting provider’s managed certificates: Many cloud providers and CDNs offer managed SSL with auto-renewal. AWS Certificate Manager, Cloudflare SSL, and similar services handle renewal automatically. You still want external monitoring to verify the certificate is valid from a user’s perspective.
Use a monitoring service: Even with auto-renewal, monitor your certificates externally. Auto-renewal can fail. Managed certificates can have issues. External monitoring catches what internal automation misses.
Multiple domains and subdomains
If you run multiple domains or subdomains, certificate management gets complicated fast.
A small SaaS company might have: example.com, app.example.com, api.example.com, status.example.com, docs.example.com, cdn.example.com. Each needs a valid certificate. Some may use wildcard certificates (*.example.com). Others may use individual certificates from different CAs.
Monitor every one. Add an SSL monitor for each domain and subdomain. You get a single dashboard showing the status and expiry date of every certificate. When one is approaching expiry, you know which one and when.
SSL monitoring vs. uptime monitoring
SSL monitoring and uptime monitoring serve different purposes. Uptime monitoring says “your site is reachable.” SSL monitoring says “your site is reachable and the connection is secure.”
A site with an expired certificate might still be technically “up” from a TCP perspective. The server responds. But the browser blocks access. An uptime monitor configured to check HTTP status codes would see the response. But if the monitor follows redirects or accepts any response, it might not catch the cert issue.
Run both. Uptime monitoring for reachability. SSL monitoring for certificate health. They complement each other.
Certificate transparency monitoring
A newer approach to SSL monitoring: certificate transparency (CT) logs. Every publicly trusted CA must log certificates to CT logs. You can monitor these logs for new certificates issued for your domains.
This catches two things: legitimate certificates you did not know about (someone on your team bought one from a different CA) and malicious certificates (someone impersonating your domain).
Tools like Cert Spotter and Facebook’s Certificate Transparency Monitor provide this. It is an advanced measure, but useful for companies with strict security requirements.
Get started
PingWatchdog includes SSL monitoring on every plan. The Free plan covers your domains with 24-hour checks and 30/14/7-day expiry alerts. No separate tool. No separate subscription.
Set up SSL monitoring or learn about all monitoring features. Also read: what is uptime monitoring?