SSL Certificate Monitoring — Never Get Caught by an Expired Cert Again

An expired TLS certificate is one of the most avoidable outages there is — and one of the most damaging. The moment it lapses, every visitor hits a full-page browser warning (NET::ERR_CERT_DATE_INVALID), APIs that call your endpoint start refusing the connection, and your conversion rate drops to roughly zero until someone notices. It has happened to Microsoft, Google, Spotify, and thousands of teams who were sure auto-renewal had it covered.

Here's why certificates still expire in the age of Let's Encrypt, what you should actually monitor, and how to make sure you're warned weeks ahead instead of by an angry customer.

Why "we have auto-renewal" isn't enough

Let's Encrypt and ACME automation are excellent — and certificates still expire anyway, because renewal is a multi-step process and any step can silently fail:

• The renewal cron didn't run. The certbot timer got disabled during an unrelated change, or the box was down at renewal time.
• Renewal succeeded but the service wasn't reloaded. The new cert is on disk, but nginx/Apache is still serving the old one from memory. This one catches people constantly.
• A domain-validation change broke ACME. DNS moved, a redirect changed, or the .well-known path stopped being reachable, so the challenge fails.
• The cert isn't Let's Encrypt at all. Plenty of production certs are still manually-issued 1-year certs from a commercial CA, with renewal that depends on a human remembering.
• A load balancer or CDN has its own copy. You renewed on the origin, but the cert on the edge (or on a specific node in a pool) is a different, older one.

Auto-renewal reduces the odds of expiry. It does not eliminate them, and it gives a false sense of safety that makes teams stop watching — which is exactly when it bites.

What to actually monitor

Good certificate monitoring is more than "days until expiry." Watch all of these:

• Days until expiry, with alerts at sensible thresholds — e.g. 30, 14 and 7 days out. Thirty days gives you time to fix a broken renewal calmly; seven days is your last-chance page.
• The full chain. A certificate can be valid while its intermediate is missing or expired, which breaks validation for many clients even though a quick browser test looks fine.
• Hostname match. The cert must actually cover the hostname being served (including www vs apex, and every SAN you rely on).
• The cert that's actually served, not the one on disk. Monitoring must connect over TLS to the live endpoint — that's the only way to catch the "renewed but not reloaded" and "edge node has an old cert" failure modes.
• Every endpoint, not just the apex. api., www., status., and any regional hostnames each have their own certificate lifecycle.

Set alert thresholds you'll actually act on

The classic mistake is a single alert on the expiry day — useless, because by then you're already down. The second mistake is alerting too early and too often, so the warnings become noise you tune out.

A good default: a first heads-up at 30 days, a firmer nudge at 14 days, and an urgent page at 7 days. Route the 30-day notice to a channel your team reads daily; escalate the 7-day one to whatever actually pages a human. If a cert reaches 7 days, something in your renewal automation is broken and needs hands-on attention — treat it as an incident, not a reminder.

A prevention checklist

• Enable automated renewal (ACME/certbot) wherever you can — it's still the right baseline.
• Reload the web server after renewal, and verify it actually picked up the new cert.
• Monitor the live TLS endpoint for every hostname, not the files on disk.
• Alert at 30 / 14 / 7 days, to channels matched to urgency.
• Include intermediate-chain and hostname-match checks, not just the expiry date.
• Re-check after every infrastructure change that touches TLS — new load balancer, new CDN, DNS move.

Let monitoring do the remembering

Certificates expire because remembering is a human job, and humans are busy. Monitoring turns it into a machine job. CompleteStatus connects to your live endpoints over TLS, tracks days-to-expiry with tiered alerts, verifies the chain and hostname, and pages you well before anything lapses — alongside your uptime, DNS, security-header and email-authentication monitoring in one dashboard.

Check any certificate right now with the free SSL / TLS certificate checker — it reports expiry, chain and hostname match in seconds. Then start monitoring free so you're warned weeks ahead, automatically. The free tier allows commercial use.