An expired TLS certificate does not degrade your site — it replaces it with a full-screen browser warning that stops every visitor at the door. The fix takes ten minutes. Knowing in time is the whole problem.
From $5 a month · No check quotas · Set up in under a minute
What is SSL certificate expiration monitoring?
SSL certificate expiration monitoring is an automated check that reads the TLS certificate served by a domain, records its expiry date, and alerts you a set number of days before it lapses. MonitoringDaddy checks certificates on a schedule and lets you choose the warning window — 1, 2, 3, 7, 14, 30 or 60 days ahead — so the renewal lands on someone's desk long before the browser warning lands on your customers' screens.
Certificate expiry is one of the few outages that is completely predictable. The date is known months in advance, printed inside the certificate itself, and readable by anyone. It still takes sites down constantly — not because the date is a surprise, but because nobody was watching for it and the person who set up the certificate has since changed jobs.
Auto-renewal has made this better and, in a specific way, worse. Certbot and ACME clients renew silently until the day they do not: a cron job that stopped, a webroot that moved, a DNS challenge that broke, a firewall rule that blocked the validation request. Because the renewals were invisible while they worked, the failure is invisible too — right up until the certificate expires.
Not a slow degradation. A hard stop, on every browser, for every visitor.
Browsers show a full-screen security warning that most users will not click through — and should not. Your traffic does not dip, it stops. Conversion goes to zero for the duration.
Anything calling your API over HTTPS — mobile apps, partner integrations, webhooks, payment callbacks — starts throwing TLS errors immediately. Integrations that retry will hammer you; ones that do not will silently lose data.
Crawlers hitting a certificate error during the outage may drop pages from the index. Recovery takes considerably longer than the ten minutes it took to renew the certificate.
A browser telling a customer your site is "not secure" is a message they remember well past the moment you fix it, especially on a checkout page.
The asymmetry is what makes this worth automating: renewing a certificate takes minutes, and the outage from missing that window is total. There is no partial failure mode to absorb it.
Enable it on any monitor, choose the warning window, done.
MonitoringDaddy connects to the host, reads the certificate actually being served, and records its expiry date. That matters more than it sounds: it verifies what visitors receive, not what your renewal script believes it installed. A certificate that renewed successfully but was never loaded by the web server is one of the most common real-world failures, and only an external check catches it.
Alert windows are 1, 2, 3, 7, 14, 30 or 60 days before expiry. Most teams want two: one early warning that gives the renewal a home in the sprint, and one urgent alert close to the date for when the first was ignored.
Email, Slack, Microsoft Teams, Discord, Telegram, Flock or a generic webhook — several at once on the same monitor if you want both an inbox and a channel notified.
Pair SSL monitoring with an ordinary uptime check on the same URL. They catch different failures: uptime tells you the server stopped answering, SSL expiry tells you it is about to start answering with a warning page. See the uptime monitoring guide.
Create a monitor pointing at the HTTPS URL you want watched. The same monitor handles uptime and certificate checks.
Switch on SSL certificate monitoring in the monitor settings. It reads the certificate the host actually serves.
Choose how many days before expiry to be alerted — 1 to 60 days. Two monitors with different windows gives you an early nudge and a late alarm.
Add email plus whatever chat channel your team lives in, and save. Checking starts immediately.
Teams reliably monitor the main domain and reliably forget everything else. The forgotten ones cause the outages.
| Endpoint | Why it gets missed | Priority |
|---|---|---|
| Primary domain | Nobody forgets this one | Essential |
| www and apex variants | Often a separate certificate from the one you think of | Essential |
| API subdomains | No human visits them, so nobody sees the warning until integrations break | Essential |
| Checkout and payment hosts | Sometimes a separate host with its own certificate and its own renewal | Essential |
| Customer custom domains | Each one is its own certificate, and the customer will notice before you do | High |
| Staging and admin panels | Renewal automation is often set up hastily and never verified | Medium |
| Mail and webmail hosts | Certificate failures here break clients silently, with no browser warning to see | Medium |
| Legacy and redirect domains | Old domains still pointed at you, still serving TLS, owned by nobody | Medium |
MonitoringDaddy tracks certificate expiry. It is not a full TLS configuration auditor, and it should not be your only line of defence for certificate security.
A 30-day alert to schedule the work and a 7-day alert to escalate it. One alert gets triaged into a backlog; two makes the second one impossible to ignore.
Auto-renewal handles issuance. It does not guarantee the new certificate was loaded by the web server, or that it was installed on every host behind the load balancer. Only an outside-in check confirms what visitors actually receive.
One monitor per certificate-bearing hostname. The API subdomain and the checkout host are separate certificates with separate failure modes, however unified the marketing site feels.
Certificate alerts that land in a shared inbox belong to nobody. Route them to the channel where infrastructure work actually gets picked up, and pair with domain expiry monitoring — the two renewals fail the same way for the same reason.
Monitor any HTTPS endpoint for certificate expiry and get alerted before it lapses.
Create a monitor pointing at the HTTPS URL whose certificate you want to watch.
Turn on SSL certificate monitoring in the monitor settings so the check reads the certificate the host actually serves.
Select how many days before expiry to be alerted — options run from 1 to 60 days.
Add email, Slack, Microsoft Teams, Discord, Telegram or a webhook, then save. Checking begins immediately.
Typically about 2 minutes from start to finish.
Uptime monitors, watched pages and heartbeats each get their own allowance, so adding a page watch never costs you a monitor. SSL and domain checks ride along with the monitor they belong to and use nothing extra.
| Plan | Monitors | Watched pages | Heartbeats | Fastest interval | Alert channels | Price |
|---|---|---|---|---|---|---|
| Free | 1 | 1 | 1 | Every 30 minutes | 1 email address | $0 |
| Founding Member first 20 only | 25 | 25 | 25 | Every 5 minutes | Email + webhook & chat | $5/mo |
| Basic | 10 | 10 | 10 | Every 10 minutes | Email + webhook & chat | $8/mo |
| Growth | 50 | 50 | 50 | Every 5 minutes | Email + webhook & chat | $19/mo |
| Pro | 100 | 100 | 100 | Every 60 seconds | Email + webhook & chat | $34/mo |
Annual billing is cheaper on every paid tier. The pricing page is the authoritative list.
Every recorded change is compared word by word and kept with a before-and-after image. This is the real output, shown with worked example data.
Price fell from $49 to $39, and an annual discount was added.
The item is available again and the basket button returned.
A new subprocessor was added in another jurisdiction.
The free plan sends to one email address. Every paid plan adds the chat and webhook channels below, with 2 to 10 destinations depending on the plan. However many alerts you receive, the price does not change — nothing here is metered or charged per alert.
There are no voice calls and no SMS. If a phone call at 3am is a hard requirement, say so before you subscribe — we would rather tell you now than refund you later.
An automated check that reads the TLS certificate a domain serves, records its expiry date, and alerts you a chosen number of days before it lapses — so the renewal happens before browsers start showing security warnings.
Alert windows are 1, 2, 3, 7, 14, 30 or 60 days before expiry. Many teams run two monitors with different windows: an early one to schedule the renewal and a late one to escalate.
Yes, and arguably more than if you renewed by hand. Auto-renewal fails silently — a stopped cron job, a moved webroot, a broken DNS challenge, a firewall rule blocking validation. Because the renewals were invisible while working, the failure is invisible too. An external check verifies the certificate visitors actually receive.
Yes. The check connects to the host and reads the live certificate rather than trusting a renewal log. That distinction catches the common case where a certificate renewed correctly but was never loaded by the web server.
Yes — each hostname gets its own monitor. API subdomains and checkout hosts are worth covering precisely because no human visits them, so nobody sees the warning until integrations break.
Email, generic webhooks, Slack, Microsoft Teams, Discord, Telegram and Flock, with SMS where SMS delivery is enabled. One monitor can carry several channels.
Yes. The free plan covers 1 monitor with 30-minute checks and email alerts, and SSL certificate monitoring is available on it. Paid plans from $5/month add more monitors and faster checks.
No. This tracks expiry, not configuration quality. Cipher suites, protocol versions and hardening need a dedicated TLS scanner — we would rather be clear about that than imply a security audit we do not perform.
Yes, on plans that include API access. See the SSL monitoring API reference for creating and managing certificate monitors programmatically.
An SSL certificate typically expires every 90 days to a year and breaks HTTPS when it lapses. A domain registration expires on a multi-year cycle and takes the entire domain offline — DNS, email, everything. Both are predictable, both are forgotten, and they need separate monitors. See domain expiration monitoring.
Last updated August 4, 2026 · Written by Amit Gupta, founder of MonitoringDaddy
Add your first certificate monitor in under a minute. Free plan, no credit card, alerts up to 60 days ahead.