> Markdown version of https://getuptimely.com/features/ssl-certificate-monitoring — the page itself is the canonical copy. Features # How to monitor SSL certificate expiry To monitor SSL certificate expiry, read the certificate on a schedule, compare the days it has left with a lead time you choose, and alert the moment it drops below. Uptimely does that with an SSL Certificate monitor: it reads the certificate on every check, and a rule such as Expires In Days less than 30 changes the monitor's status and opens an incident while there is still time to renew. Add a rule on trust and hostname too, and the same monitor catches a broken chain or a certificate issued for the wrong host. Want the days left on a certificate right now, with no sign-up? [Free SSL certificate checker →](https://getuptimely.com/tools/ssl-certificate-checker) What breaks when a certificate lapses: every browser blocks the page behind a full-screen warning (Chrome names the error NET::ERR\_CERT\_DATE\_INVALID), and everything else that talks to the host over TLS fails with it. curl exits with code 60, Node.js rejects the connection with CERT\_HAS\_EXPIRED, mobile apps and webhooks from other services stop, and a mail server on port 465 or 993 turns its clients away. A website monitor catches all of that, but only once it has happened. Watching the certificate itself is how you hear about it weeks earlier, while renewing is a routine job and not an outage. Renewal usually happens on its own, which is exactly why a broken renewal goes unnoticed until the day it matters: an expired API token at the certificate authority, a DNS change that broke the ACME challenge, or a load balancer still serving the certificate it was handed a year ago. An SSL Certificate monitor is its own monitor type, separate from a website monitor. Out of the box it goes offline only when it cannot read a certificate at all. An expired or untrusted certificate is detected on every check, but it pages nobody until you add a rule for it, and the steps below cover the rules most teams start with. When to alert depends on who renews. If a person renews by hand, 30 days leaves time to buy, validate and install the certificate, and a second rule at 7 days is the reminder that the first one was ignored. If an ACME client renews automatically, alert later than its renewal point, so that the alert means the renewal has failed rather than that it is due: Let's Encrypt issues 90-day certificates and its integration guide says to renew 30 days before expiry (letsencrypt.org, read 2026-11-09), so a rule at 20 or 14 days fires only when that renewal has stopped working. Add Expires In Hours less than 24 on every certificate, including short-lived ones that renew daily, so the last day never passes in silence. How the expiry reminders work: there is no fixed reminder schedule, because you choose the lead time. Each check reads the days and hours the certificate has left, and a rule such as Expires In Days less than 30, or Expires In Days less than 14, is met on the first check that falls below it. The monitor changes status on that check, and opens one incident once it has failed the monitor's failure threshold of consecutive checks (2 by default, adjustable from 1 to 10 per monitor). That incident stays open while the rule keeps matching and resolves on its own once a renewed certificate no longer does. The reminder reaches your team on the channels you have set up, which can be email, SMS, Slack, Discord and browser push, and an on-call policy can phone the person on duty. ## How to monitor SSL certificate expiry in Uptimely 1. Check the certificate once, with no account: put the host into the free SSL certificate checker linked above to see the days left, the issuer and whether the chain is trusted today. 2. Create a monitor and choose SSL Certificate. Enter the host, such as example.com, or host:port for another service, such as mail.example.com:465. 3. In the monitor's criteria, add a rule on Expires In Days, Less Than, 30 (20 or 14 if an ACME client renews at 30 days), and turn on Change Monitor Status and Create Incident. 4. Add Expires In Hours, Less Than, 24 as a second rule and Is Not A Valid Certificate as a third, so the last day, a broken chain and a wrong hostname reach you too. 5. Choose who hears about it: email, SMS, phone call, Slack, Discord and browser push, or an on-call policy that phones the person on duty. Leave the failure threshold at 2 consecutive checks, so one flaky read never opens an incident. ## What an SSL certificate monitor checks __Checked on every run of an SSL Certificate monitor. A rule in the monitor's criteria decides which findings change its status and open an incident.__ | Check | What it catches | Without a rule | Rule that alerts on it | | ----------------------- | --------------------------------------------------------------------------------- | ------------------------ | ------------------------------- | | Certificate can be read | The host is unreachable, the port is closed, or the TLS handshake never completes | The monitor goes offline | None needed | | Days left | A renewal that stopped working, weeks before the certificate lapses | Checked, no alert | Expires In Days, Less Than, 30 | | Hours left | The final day before expiry, useful for short-lived certificates | Checked, no alert | Expires In Hours, Less Than, 24 | | Trusted chain | A self-signed certificate, a missing intermediate or an untrusted issuer | Checked, no alert | Is Not A Valid Certificate | | Hostname match | A certificate issued for a different host than the one you entered | Checked, no alert | Is Not A Valid Certificate | | Already expired | A certificate past its end date that is still being served | Checked, no alert | Is Not A Valid Certificate | ## How expiry alerts compare __When an SSL certificate expiry alert fires. Each vendor row quotes the vendor's own page, linked with the date it was read.__ | Service | Expiry alert | Source | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | | Uptimely | Fires at the lead time you set, in days or in hours, through a rule such as Expires In Days, Less Than, 30\. Available on every plan, Free included. | [Uptimely docs](https://getuptimely.com/docs/monitors) | | UptimeRobot | Its pricing page: "Alerts you 30/14/7 days before your SSL certificate expires and on the expiry day, or on days you choose." | [Vendor page](https://uptimerobot.com/pricing/), read 2026-11-09 | | Better Stack | Its docs: SSL certificate monitoring "is built into uptime monitors and keyword monitors", and "Certificate expiration alerts require a paid plan." | [Vendor page](https://betterstack.com/docs/uptime/ssl-certificate-monitor/), read 2026-11-09 | ## What you get - **Days and hours left.** Every check reads how long the certificate has left, in days and in hours, and a rule can act on either. - **Trust and hostname checks.** Every check verifies that the certificate is signed by a trusted authority, issued for the host you entered, and not expired. A self-signed certificate fails that check. - **Any host and port.** Check a website on port 443, or put the port in the address, such as mail.example.com:465, for mail servers and other TLS services. - **Expiry reminders on your terms.** Get the reminder 30 days before expiration, at 14, or 24 hours out, or whenever the certificate fails verification. Each rule can change the monitor's status and open an incident. - **Alerts on every channel.** Alerts go out by email, SMS, phone call, Slack, Discord and browser push, the same channels every other monitor uses. ## What the Free plan includes - 10 monitors: one per certificate you watch - Expiry, trust and hostname checks - Incidents, on-call and alerts - No credit card, and no time limit Every plan and limit is on the [pricing page](https://getuptimely.com/pricing). ## Questions ### What is SSL certificate monitoring? SSL certificate monitoring is checking a site's TLS certificate on a schedule, so that an expiry, a broken chain or a certificate issued for the wrong host is caught before visitors see a browser warning. Uptimely does it with an SSL Certificate monitor: it connects to the host, reads the certificate, and checks the days left, whether it is trusted and whether it matches the host. The rules you add decide which of those findings alert your team. ### Can Uptimely remind me before my SSL certificate expires? Yes, once you add an expiry rule. Set Expires In Days to less than 30, or whatever lead time you want, and the monitor changes status when the certificate crosses that line and opens an incident once it has failed the monitor's failure threshold of consecutive checks (2 by default), with the reminder sent on the channels you chose. Without a rule, the monitor reads the days left but does not alert on them. ### How do I monitor SSL certificate expiration? Create an SSL Certificate monitor for the host, add a rule on Expires In Days, Less Than, 30, and turn on Change Monitor Status and Create Incident. Uptimely then tracks the days left on every check, and when the certificate crosses that line your team gets the expiry reminder on the channels you chose. For a one-off look with no account, the free SSL certificate checker shows the same days-left figure. ### How many days before expiry should the alert fire? 30 days if a person renews by hand, with a second rule at 7 days as the backstop. 20 or 14 days if an ACME client renews automatically: Let's Encrypt's guidance is to renew 30 days before expiry, so a rule at 30 would fire during every healthy renewal cycle, while one at 20 fires only when the renewal has failed. Add Expires In Hours less than 24 in every case, so the final day is never silent. ### What happens when an SSL certificate expires? Browsers refuse to load the site without a full-screen warning, API clients fail the TLS handshake (curl exits with code 60, Node.js reports CERT\_HAS\_EXPIRED), webhooks from other services stop arriving, and mail clients reject the server. The site itself is still running; nothing can reach it safely. Installing a renewed certificate fixes it on the next connection, with no DNS change to wait for. Uptimely does not renew it: renewal stays with whatever issues your certificates today, such as your host, your load balancer or a tool like certbot, and Uptimely tells you when that process has stopped working. ### How do I check when my SSL certificate expires? Run the host through the free SSL certificate checker, which prints the expiry date and the days left. On a machine with OpenSSL, pipe the output of openssl s\_client -connect example.com:443 -servername example.com into openssl x509 -noout -enddate, and the notAfter line is the expiry date. Both are one-off answers; a monitor is what turns that date into an alert. Watch your first certificate on the Free plan. No credit card needed. [Monitor a certificate →](https://app.getuptimely.com/accounts/register?utm%5Fsource=getuptimely.com&utm%5Fmedium=growth&utm%5Fcampaign=ssl-certificate-monitoring) ## Read next - [Free SSL certificate checker](https://getuptimely.com/tools/ssl-certificate-checker) - [SSL certificate expiry explained](https://getuptimely.com/glossary/ssl-certificate-expiry) - [SSL certificate expired](https://getuptimely.com/errors/ssl-certificate-expired) - [SSL/TLS handshake failed](https://getuptimely.com/errors/ssl-handshake-failed) - [525 SSL Handshake Failed](https://getuptimely.com/errors/525) - [526 Invalid SSL Certificate](https://getuptimely.com/errors/526) - [Monitors in the docs](https://getuptimely.com/docs/monitors) Verified 2026-11-09 by the Uptimely team. Part of [what Uptimely does](https://getuptimely.com/features). Something here read wrong to you? Email **support@getuptimely.com**.