SSL certificate expiration monitoring
Upcheck performs a real TLS handshake with every hostname you own, tracks the days remaining on the certificate it actually serves, verifies the chain and hostname coverage, and tells the right people well before one lapses — by email, Slack, Discord, Teams, or webhook.
$10/month base · $1 per website · checks every 12 hours
Certificates now expire faster than teams can remember them
An expired certificate is one of the few faults that takes a site down completely and instantly. There is no degraded mode: every browser throws a full-page security interstitial, API clients refuse the handshake outright, and the failure is total from the second the validity window closes. It is also, almost always, entirely avoidable — the date was known months in advance.
What has changed is the pace. Under CA/Browser Forum ballot SC-081v3, the maximum lifetime of a public TLS certificate is on a published reduction schedule. Renewal stopped being an annual calendar entry and became a recurring operational process — and the SSL expiry monitoring most teams rely on, a renewal date in a shared calendar, has not kept up with it.
Maximum certificate lifetime under the CA/Browser Forum Baseline Requirements.
Shorter lifetimes push everyone toward automated renewal, which is the right answer — but automation is not a monitoring strategy, because automated renewal fails silently by design. A DNS API token expires. A validation path moves during a deploy. The ACME client renews the certificate perfectly and the load balancer keeps serving the old one from a cache. In each case the renewal job reports success and the hostname is still minutes from an outage.
The only thing that settles it is reading what the server actually presents on a live connection, repeatedly, from outside your own infrastructure. That is precisely what Upcheck does.
Monitoring SSL certificate expiration in three steps
- 01
Add the hostnames you own
Give Upcheck a hostname and it opens a real TLS connection from the outside — the same handshake a visitor's browser performs — and records the certificate the server actually presents. No agent to install, no DNS record to add, no code on your side.
- 02
Every certificate, re-checked twice a day
A scheduled job re-runs the handshake for every website every 12 hours and compares what it finds against the last check, so a certificate that gets replaced, revoked, or misdeployed shows up on the board within hours rather than at the next audit. You can also refresh any website on demand from the dashboard.
- 03
Alerts fire at your thresholds
Set the warnings that suit your renewal process — 30 days, 14 days, 7 days, on the day itself — and pick where each one lands. Rules can cover every website or just the ones that matter.
The expiry date is one field of many
A monitor that only reads notAfter tells you when a certificate dies, and nothing about whether the one in front of you is the one you meant to deploy — or whether a browser will trust it. Upcheck validates the whole certificate on every check: the chain to the root, the names it covers, the key, the fingerprint. The renewal that technically succeeded but shipped the wrong chain is visible rather than latent.
Because each check is kept, you also get the diff over time: a fingerprint that changed when nobody deployed, a key size that dropped, an intermediate that vanished from the chain. Every website carries its own check history, and the workspace keeps an activity feed of what changed and who changed it.
Expiry reminders at thresholds you choose, repeated until someone acts
An alert rule carries as many thresholds as you want it to, and each one sends its own notification. Warn at 30 days, again at 14, again at 7, and once more on the expiry date — from a single rule, so there is no chain of near-duplicate rules to maintain. Thresholds are expressed in days or weeks, whichever matches how your team talks about the renewal.
Each rule then picks a cadence: fire once when the threshold is crossed, daily until expiry, or every 12 hours for the ones that genuinely cannot slip. Rules apply to your whole organization by default, or you can scope one to specific websites — so the marketing site and the payments API do not have to share an escalation policy.
Delivery goes to email, Slack, Discord, Microsoft Teams, or your own webhook. Email recipients live in named lists you define once and point any rule at, which means the people who hear about a certificate can change without anyone rewriting rules. Team members are invited into the workspace with roles, so the on-call rotation and the person who owns billing are not forced to be the same account.
Every state a certificate can be in
Expiry is the failure everyone plans for. These are the ones that take sites down between renewals — each is a status on the board and can trigger the same alert channels.
- Expiring soon
Inside your warning window. This is the state the whole product exists to give you time inside of.
- Expired
The certificate's validity window has closed. Browsers are now showing an interstitial to every visitor.
- Invalid
The certificate is present but fails validation — a broken chain, a missing intermediate, or a name that doesn't match the host.
- Host unreachable
The handshake never completed. DNS, the listener, or the network is down, and a certificate you cannot reach is one you cannot verify.
- Renewed
The certificate changed since the last check. Confirms automation worked — and surfaces swaps nobody scheduled.
Anything inside 21 days of expiry is flagged as expiring soon on the dashboard, independently of the alert rules you configure.
The certificate is one of four ways a site goes dark
A dedicated certificate monitor answers one question. Upcheck watches the same websites four ways, on one board, under one bill — because during an incident, “which tool do I open” is a question nobody should be asking.
Uptime
Every website is probed every 5 minutes, with outages confirmed before anyone is woken up.
DNS
Records are read on a schedule, so the change that silently redirected your traffic shows up.
Domain registration
Registry expiry watched over RDAP — a certificate on a lapsed domain is not worth much.
What to look for in an SSL certificate monitoring tool
Certificate monitoring shows up in two forms: a checkbox bolted onto an uptime suite, or a single-purpose tool that does nothing else. If certificate expiry is the thing you are actually trying to solve, these are the capabilities that decide whether it works.
- 01
Checks from outside your infrastructure
A cron job on the server can read a certificate the load balancer never serves. Only an external handshake sees what your visitors see — which is the thing that actually goes wrong.
- 02
Multiple thresholds per rule
One warning is a single point of failure. A tool should let one rule fire at 30, 14, and 7 days so a missed notification isn't a missed renewal.
- 03
Repeat until resolved
A single notice at 30 days can be read and forgotten. Escalating repetition as the date closes is what actually gets it renewed.
- 04
Validation, not just a date
An expiry countdown misses the broken chain, the missing intermediate, and the certificate that doesn't cover the hostname. All three throw the same browser interstitial an expiry does.
- 05
Alerts where the team already is
An email to a shared inbox nobody reads is not an alert. Look for Slack, Discord, Teams, and a plain webhook for your own tooling — with recipients that outlive individual employees.
- 06
History you can audit
"When did this change, and who changed it" needs per-website check history compared against the last check, and an activity trail — not a dashboard that only knows about right now.
Comparing dedicated certificate monitors? The honest TrackSSL alternative comparison weighs a single-purpose tool against watching the whole website.
Priced by what you actually monitor
$10 per month for the workspace, plus $1 per website per month. The per-website charge is metered daily, so adding a hostname mid-cycle costs only the days it was tracked, and removing one stops the charge that day. Every feature on this page is included at every size — there is no tier that withholds Slack, or webhooks, or history. A workspace can track up to 500 websites.
Want to see a certificate before you sign up for anything? The free SSL checker inspects any site's certificate right now.
Frequently asked questions
What is SSL certificate expiration monitoring?
SSL certificate expiration monitoring is the practice of automatically checking the TLS certificate on each of your hostnames, tracking how many days remain until it expires, and alerting a responsible team before it lapses. A monitor connects to the host, reads the certificate the server presents, and compares its expiry date against thresholds you set — so the warning arrives with enough lead time to renew and deploy.
What is the difference between SSL certificate monitoring and SSL certificate expiration monitoring?
Expiration monitoring tracks one field: how many days remain until a certificate lapses. SSL certificate monitoring is the broader practice — it includes expiry tracking, but also validates the chain of trust, checks the certificate covers the hostname, confirms the host completes a handshake at all, and detects when the deployed certificate changes. In practice the two are bought and used together, and Upcheck does both on every check.
How is SSL monitoring different from uptime monitoring?
Uptime monitoring asks whether the site answers at all: an HTTPS request every 5 minutes, with an outage confirmed on a second failed probe before anyone is alerted. Certificate monitoring asks whether what it answers with is still trusted: a real TLS handshake twice a day that reads the expiry date, the chain of trust, and the hostname coverage. What differs is when you hear about a problem. An expired certificate eventually fails the uptime check too, because the handshake stops completing — but by then every visitor is already looking at a browser interstitial, while the certificate check warned you thirty days earlier. Both run on every website you add, so this sits alongside uptime monitoring rather than replacing it.
How often does Upcheck check for certificate expiration?
Every website is re-checked automatically every 12 hours. You can also refresh any website — or all of them — on demand from the dashboard, which runs the TLS handshake immediately and updates the certificate detail and status.
How far in advance should I be warned before a certificate expires?
Start at 30 days. That leaves room to issue, validate, deploy, and verify without touching production under pressure. Add reinforcing warnings at 14 and 7 days, and one on the expiry date itself. If a renewal needs manual CA validation, widen the first threshold to 45 or 60 days.
Can Upcheck send certificate expiry reminders to my team?
Yes — that is what an alert rule does. Each threshold you set sends its own expiry notification, and a rule can repeat it daily, or every 12 hours, until the certificate is renewed. Reminders go to a shared destination rather than one person: named email lists you define once, Slack, Discord, Microsoft Teams, or your own webhook — so the people who hear about a renewal can change without anyone rewriting rules.
Does automated renewal make expiration monitoring unnecessary?
No. ACME automation reduces how often certificates expire, but it fails quietly — a lapsed DNS credential, a changed validation path, a renewed certificate that never reached the load balancer. Monitoring reads what the server actually serves, which is the only thing your visitors experience, so it catches the gap between "renewal ran" and "renewal worked".
What SSL problems can monitoring catch besides an expired certificate?
An invalid certificate — a broken chain, a missing intermediate, or a name that doesn't match the host, all of which show visitors the same full-page browser warning an expiry does. An unexpected certificate change, caught by comparing fingerprints between checks. And an unreachable host, where the handshake never completes at all. Each is its own status on the Upcheck board.
Can I monitor SSL certificate expiration for free?
You can check a certificate by hand for free with openssl s_client or an online SSL checker. That works for a single host at a single moment, but it is manual, gives you nothing when the certificate changes next month, and does not scale past a handful of names. Upcheck costs $10 per month for the workspace plus $1 per website per month.
Can I monitor certificates on internal hosts?
Upcheck performs its checks over the public internet, so it monitors any hostname it can reach and complete a TLS handshake with. Certificates on hosts that are only resolvable inside a private network are out of scope.
Stop finding out from a customer.
Add your hostnames, set the thresholds your renewal process needs, and choose where the warnings land.