SSL certificate monitoring
Upcheck performs a real TLS handshake with every hostname you own, verifies the certificate the server actually presents — validity, chain, hostname coverage, expiry — and tells the right people the moment something needs a human.
$10/month base · $1 per website · checks every 12 hours
What is SSL certificate monitoring?
SSL certificate monitoring is the automated, repeated checking of the TLS certificates your servers actually present to visitors. A monitor connects to each hostname from the outside, performs the same handshake a browser would, and verifies what comes back: the certificate is inside its validity window, the chain of trust is complete, the names on it cover the host, and nothing has changed since the last check that nobody meant to change.
The distinction that matters is what the server serves, not what your tooling reports. A renewal job can succeed while a load balancer keeps serving the old certificate from a cache. A deploy can ship a certificate with a missing intermediate that works in the browser that has it cached and fails in every one that doesn't. Every failure mode ends the same way — a full-page security warning shown to your visitors — and none of them announce themselves to you first.
Expiry tracking is the best-known slice of this, and it is deep enough to have its own page covering renewal thresholds and the shrinking certificate-lifetime schedule. This page is about the whole job: everything Upcheck verifies about a certificate, on every check.
How an SSL monitor earns its keep
- 01
Add the hostnames you own
Give Upcheck a hostname and it opens a real TLS connection from the outside — the same handshake a visitor's browser performs — and records the certificate the server actually presents. No agent to install, no DNS record to add, no code on your side.
- 02
Every certificate, re-checked twice a day
A scheduled job re-runs the handshake for every website every 12 hours and compares what it finds against the last check. You can also refresh any website on demand from the dashboard when you have just deployed and want the answer now.
- 03
Alerts when something needs a human
Expiry warnings fire at the thresholds you set — 30, 14, 7 days, the day itself — and every certificate carries a live status on the board. Delivery goes to email, Slack, Discord, Microsoft Teams, or your own webhook.
More than an expiry countdown
Every check stores the whole certificate, and every certificate carries a live status on the board: expiring soon inside your warning window, expired or invalid when visitors are already seeing a warning, renewed when the certificate changed since the last check, and host unreachable when the handshake never completed at all.
Because each check is kept, SSL cert monitoring becomes a diff over time rather than a snapshot: a fingerprint that changed when nobody deployed, a key size that dropped, an intermediate that vanished from the chain. Every website carries its own check history, and the workspace keeps an activity feed of what changed and who changed it. Anything inside 21 days of expiry is flagged on the dashboard independently of the alert rules you configure.
Warnings that reach the people who can act
Alert rules carry the thresholds your renewal process needs — 30, 14, and 7 days and the expiry date itself can live on a single rule — and each rule picks its own cadence: once when crossed, daily until expiry, or every 12 hours for the certificates that genuinely cannot slip. Rules cover the whole organization by default or scope down to specific websites, so the marketing site and the payments API do not share an escalation policy.
Delivery goes to email, Slack, Discord, Microsoft Teams, or your own webhook. Email recipients live in named lists you define once and point any rule at, so the people who hear about a certificate can change without anyone rewriting rules.
The certificate is one of four ways a site goes dark
A dedicated certificate monitor answers one question. Upcheck watches the same websites four ways, on one board, under one bill — because during an incident, “which tool do I open” is a question nobody should be asking.
Uptime
Every website is probed every 5 minutes, with outages confirmed before anyone is woken up.
DNS
Records are read on a schedule, so the change that silently redirected your traffic shows up.
Domain registration
Registry expiry watched over RDAP — a certificate on a lapsed domain is not worth much.
What to look for in an SSL monitoring tool
Certificate monitoring shows up in two forms: a checkbox bolted onto an uptime suite, or a single-purpose tool that does nothing else. Whichever direction you come from, these are the capabilities that decide whether it works.
- 01
Checks from outside your infrastructure
A cron job on the server can read a certificate the load balancer never serves. Only an external handshake sees what your visitors see — which is the thing that actually goes wrong.
- 02
Validation, not just a date
An expiry countdown misses the broken chain, the missing intermediate, and the certificate that doesn't cover the hostname. All three throw the same browser interstitial an expiry does.
- 03
Change detection
A fingerprint that changed when nobody deployed is a question worth asking. A monitor should compare every check against the last one, not just read the current state.
- 04
Alerts where the team already is
An email to a shared inbox nobody reads is not an alert. Look for Slack, Discord, Teams, and a plain webhook for your own tooling — with recipients that outlive individual employees.
- 05
History you can audit
"When did this change, and who changed it" needs per-website check history and an activity trail — not a dashboard that only knows about right now.
- 06
The rest of the website too
The certificate is one of four ways a site goes dark. If DNS, the domain registration, and uptime need separate tools, you have four bills and four places to look during an incident.
Weighing a dedicated certificate monitor against this? The honest TrackSSL alternative comparison concedes where a single-purpose tool wins.
Priced by what you actually monitor
$10 per month for the workspace, plus $1 per website per month. The per-website charge is metered daily, so adding a hostname mid-cycle costs only the days it was tracked, and removing one stops the charge that day. Every feature on this page is included at every size — there is no tier that withholds Slack, or webhooks, or history. A workspace can track up to 500 websites.
Want to see a certificate before you sign up for anything? The free SSL checker inspects any site's certificate right now.
Frequently asked questions
What is SSL certificate monitoring?
SSL certificate monitoring is the automated, repeated checking of the TLS certificates your servers actually present to visitors. A monitor connects to each hostname from the outside, performs a real TLS handshake, and verifies the certificate it receives: that it is within its validity window, that the chain of trust is complete, that it covers the hostname, and that it has not changed unexpectedly since the last check. When any of those checks fails — or an expiry threshold is crossed — the monitor alerts a responsible team.
What is the difference between SSL monitoring and SSL certificate expiration monitoring?
Expiration monitoring tracks one field: how many days remain until a certificate lapses. SSL certificate monitoring is the broader practice — it includes expiry tracking, but also validates the chain of trust, checks the certificate covers the hostname, confirms the host completes a handshake at all, and detects when the deployed certificate changes. Upcheck does both on every check; if renewals are the specific problem you are solving, see SSL certificate expiration monitoring for the renewal-process detail.
How does an SSL monitor work?
It opens a TLS connection to your hostname from outside your infrastructure, exactly as a browser would, and reads the certificate the server presents during the handshake. It then validates the certificate — dates, chain, hostname coverage — records the full detail including the SHA-256 fingerprint, and compares the result against the previous check. Because the check runs from outside, it verifies what visitors actually experience rather than what a renewal job reported.
How often does Upcheck check SSL certificates?
Every website's certificate is re-checked automatically every 12 hours. You can also refresh any website — or all of them — on demand from the dashboard, which runs the handshake immediately and updates the certificate detail and status. The same websites are probed for uptime every 5 minutes.
Is there a free SSL monitoring tool?
You can inspect any site's certificate right now with a free online SSL checker, and openssl s_client does the same from a terminal. Both are point-in-time checks: they tell you about one host at one moment and nothing when it changes next month. Continuous monitoring — scheduled re-checks, statuses, alerting — is what Upcheck charges for: $10 per month for the workspace plus $1 per website per month.
Do I need SSL monitoring if renewal is automated with Let's Encrypt or ACME?
Yes — automation is exactly why monitoring earns its keep. ACME renewal fails quietly: a DNS API token expires, a validation path moves during a deploy, or the client renews perfectly and the load balancer keeps serving the old certificate from a cache. In each case the renewal job reports success. Monitoring reads what the server actually serves on a live connection, which is the only way to catch the gap between "renewal ran" and "renewal worked".
What SSL problems can monitoring catch besides an expired certificate?
An invalid certificate — a broken chain, a missing intermediate, or a name that doesn't match the host, all of which show visitors the same full-page browser warning an expiry does. An unexpected certificate change, caught by comparing fingerprints between checks. And an unreachable host, where the handshake never completes at all. Each is its own status on the Upcheck board.
Can Upcheck monitor certificates on internal hosts?
Upcheck performs its checks over the public internet, so it monitors any hostname it can reach and complete a TLS handshake with. Certificates on hosts that are only resolvable inside a private network are out of scope.
Know before your visitors do.
Add your hostnames and Upcheck starts reading what they actually serve — twice a day, from the outside, with the warnings routed wherever your team lives.